From b9c6ea007d90c77caff01f3822fca6570b1b874b Mon Sep 17 00:00:00 2001
From: "russell@unturf.com" <russell@unturf.com>
Date: Fri, 24 Apr 2026 17:28:14 -0400
Subject: [PATCH] wave4: document PHP_CodeSniffer ReDoS + aws-cdk triage
 outcomes

Investigated the top 2 triage-backlog items from the Wave 4 survey:

- PHP_CodeSniffer Tokenizers/PHP.php ReDoS: scanner flagged
  ((?<!\.)_[0-9A-F][0-9A-F.]*)+$ as catastrophic-backtracking shape.
  Empirical test shows the underscore-anchored inner group prevents
  overlap between outer iterations; Python re matches N=50 pathological
  input in sub-millisecond time. False positive. Scanner could be taught
  to recognize anchor-prefix inner groups as safe.

- aws-cdk region-info.ts limitedRegionMap: partitions.includes inside
  per-region loop is a real O(R*P) shape. At realistic scale (R=35
  regions, P=2-4 partitions) the wall-clock improvement is constant-
  factor only; bench shows 2.9x at R=2000 P=100 but collapses to 1.0x
  at production scale. Cleanup-grade, not CWE-407 complexity-class
  emergency; no patch shipped.

Both findings documented in the Wave 4 triage section as investigated-
and-resolved. The remaining 5 items stay on the list for future waves.
---
 whitepaper/outreach/wave4-linter-ci-survey.md | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/whitepaper/outreach/wave4-linter-ci-survey.md b/whitepaper/outreach/wave4-linter-ci-survey.md
index 6ecb2e225..7c439c421 100644
--- a/whitepaper/outreach/wave4-linter-ci-survey.md
+++ b/whitepaper/outreach/wave4-linter-ci-survey.md
@@ -91,13 +91,13 @@ All three are small, tight, well-maintained codebases. Zero MOAD-pattern hits at
 
 ## Triage follow-ups identified for future waves
 
-1. **PHP_CodeSniffer Tokenizers/PHP.php** — 15 M11 CRIT ReDoS findings in PHP tokenizer; worth a targeted follow-up with a catastrophic-backtracking bench.
+1. **PHP_CodeSniffer Tokenizers/PHP.php** — 15 M11 CRIT ReDoS findings flagged. **Investigated and determined false positives**: the nested-quantifier pattern `((?<!\.)_[0-9A-F][0-9A-F.]*)+$` has an underscore-anchored inner group, so each outer iteration starts at a fresh `_` boundary — no overlap between inner group matches, no catastrophic backtracking. Empirical test at N=10..50 shows sub-millisecond match time across pathological inputs. Scanner sees shape but semantics are safe. Leaving the rule as-is; scanner could be taught to recognize the anchor-prefix case.
 2. **ktlint ELEMENT_TYPES_ALLOWING_PRECEDING_WHITESPACE.contains** — Kotlin ktlint hot path in SpacingAroundAngleBrackets rule.
-3. **pylint base_checker MSG_ORDER.index** — Python checker sort key O(N) on every message comparison.
+3. **pylint base_checker MSG_ORDER.index** — Python checker sort key O(N) on every message comparison. `_MSG_ORDER` is 5-10 items so per-sort cost is bounded; low-medium priority.
 4. **black pgen2 dfa.index** — parser generator state lookup, once at init but scales with grammar size.
-5. **golangci-lint migrate_linter_names.go** — 8 M1 hits in migration-cli code.
-6. **tektoncd/pipeline taskrun forbidden-env scan** — slices.Contains per env var on reconciler, mostly bounded-N.
-7. **aws-cdk region-info.ts** — 10 M1 hits; CDK runs per-synth, impact worth measuring.
+5. **golangci-lint migrate_linter_names.go** — 8 M1 hits in migration-cli code (one-shot tool, not a hot path).
+6. **tektoncd/pipeline taskrun forbidden-env scan** — `slices.Contains` per env var on reconciler. List is 2-4 items, bounded-N, low priority.
+7. **aws-cdk region-info.ts limitedRegionMap** — **Investigated**: `partitions.includes(...)` inside per-region loop is a real O(R×P) pattern, but realistic scale is R≈35 regions × P≈2-4 partitions. Python bench at R=2000 P=100 shows only 2.9× speedup — constant-factor improvement, not a CWE-407 complexity-class emergency. Cleanup-grade; not patch-shipped this session.
 
 ## Method