engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

wave4: document PHP_CodeSniffer ReDoS + aws-cdk triage outcomes

Browse source 
Investigated the top 2 triage-backlog items from the Wave 4 survey:

- PHP_CodeSniffer Tokenizers/PHP.php ReDoS: scanner flagged
  ((?<!\.)_[0-9A-F][0-9A-F.]*)+$ as catastrophic-backtracking shape.
  Empirical test shows the underscore-anchored inner group prevents
  overlap between outer iterations; Python re matches N=50 pathological
  input in sub-millisecond time. False positive. Scanner could be taught
  to recognize anchor-prefix inner groups as safe.

- aws-cdk region-info.ts limitedRegionMap: partitions.includes inside
  per-region loop is a real O(R*P) shape. At realistic scale (R=35
  regions, P=2-4 partitions) the wall-clock improvement is constant-
  factor only; bench shows 2.9x at R=2000 P=100 but collapses to 1.0x
  at production scale. Cleanup-grade, not CWE-407 complexity-class
  emergency; no patch shipped.

Both findings documented in the Wave 4 triage section as investigated-
and-resolved. The remaining 5 items stay on the list for future waves.
This commit is contained in:
russell@unturf.com 2026-04-24 17:28:14 -04:00
parent bb81a1a3a0
commit b9c6ea007d
No known key found for this signature in database
1 changed files with 5 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

10
whitepaper/outreach/wave4-linter-ci-survey.md
View file

@ -91,13 +91,13 @@ All three are small, tight, well-maintained codebases. Zero MOAD-pattern hits at
## Triage follow-ups identified for future waves
1. **PHP_CodeSniffer Tokenizers/PHP.php** — 15 M11 CRIT ReDoS findings in PHP tokenizer; worth a targeted follow-up with a catastrophic-backtracking bench.
1. **PHP_CodeSniffer Tokenizers/PHP.php** — 15 M11 CRIT ReDoS findings flagged. **Investigated and determined false positives**: the nested-quantifier pattern `((?<!\.)_[0-9A-F][0-9A-F.]*)+$` has an underscore-anchored inner group, so each outer iteration starts at a fresh `_` boundary — no overlap between inner group matches, no catastrophic backtracking. Empirical test at N=10..50 shows sub-millisecond match time across pathological inputs. Scanner sees shape but semantics are safe. Leaving the rule as-is; scanner could be taught to recognize the anchor-prefix case.
2. **ktlint ELEMENT_TYPES_ALLOWING_PRECEDING_WHITESPACE.contains** — Kotlin ktlint hot path in SpacingAroundAngleBrackets rule.
3. **pylint base_checker MSG_ORDER.index** — Python checker sort key O(N) on every message comparison.
3. **pylint base_checker MSG_ORDER.index** — Python checker sort key O(N) on every message comparison. `_MSG_ORDER` is 5-10 items so per-sort cost is bounded; low-medium priority.
4. **black pgen2 dfa.index** — parser generator state lookup, once at init but scales with grammar size.
5. **golangci-lint migrate_linter_names.go** — 8 M1 hits in migration-cli code.
6. **tektoncd/pipeline taskrun forbidden-env scan** — slices.Contains per env var on reconciler, mostly bounded-N.
7. **aws-cdk region-info.ts** — 10 M1 hits; CDK runs per-synth, impact worth measuring.
5. **golangci-lint migrate_linter_names.go** — 8 M1 hits in migration-cli code (one-shot tool, not a hot path).
6. **tektoncd/pipeline taskrun forbidden-env scan** — `slices.Contains` per env var on reconciler. List is 2-4 items, bounded-N, low priority.
7. **aws-cdk region-info.ts limitedRegionMap** — **Investigated**: `partitions.includes(...)` inside per-region loop is a real O(R×P) pattern, but realistic scale is R≈35 regions × P≈2-4 partitions. Python bench at R=2000 P=100 shows only 2.9× speedup — constant-factor improvement, not a CWE-407 complexity-class emergency. Cleanup-grade; not patch-shipped this session.
## Method