Investigated the top 2 triage-backlog items from the Wave 4 survey:
- PHP_CodeSniffer Tokenizers/PHP.php ReDoS: scanner flagged
((?<!\.)_[0-9A-F][0-9A-F.]*)+$ as catastrophic-backtracking shape.
Empirical test shows the underscore-anchored inner group prevents
overlap between outer iterations; Python re matches N=50 pathological
input in sub-millisecond time. False positive. Scanner could be taught
to recognize anchor-prefix inner groups as safe.
- aws-cdk region-info.ts limitedRegionMap: partitions.includes inside
per-region loop is a real O(R*P) shape. At realistic scale (R=35
regions, P=2-4 partitions) the wall-clock improvement is constant-
factor only; bench shows 2.9x at R=2000 P=100 but collapses to 1.0x
at production scale. Cleanup-grade, not CWE-407 complexity-class
emergency; no patch shipped.
Both findings documented in the Wave 4 triage section as investigated-
and-resolved. The remaining 5 items stay on the list for future waves.
russell@unturf.com
b9c6ea007d