feat(enrichment): ReDoS scanner on added/changed regex

[oktofeesh1]

Closes #1503.

Adds a REES analyzer that flags regex literals introduced by the PR (added + diff lines) vulnerable to catastrophic backtracking — a group quantified by an unbounded quantifier (+, *, {n,}) whose body also contains an unbounded quantifier (the classic (a+)+ / (\w+\.)+ shape that turns attacker-controlled input into a DoS). This is exactly the heavy/structural analysis the no-checkout in-prompt reviewer cannot do; the brief block is spliced into the review (additive + fail-safe).

Approach

Self-contained, pure-CPU — no network and no new runtime dependency. A structural detector rather than a bundled recheck/redos-detector binary, so there is no Dockerfile/runtime-image change. Structural-only keeps precision high: linear shapes like (abc)+, bounded (a+){2,4}, and non-quantified alternation (a|b)+ are not flagged.

• Extracts regex sources from added lines: /.../flags literals in regex position + new RegExp("…") / RegExp('…') constructor args. The extractors use only non-overlapping alternations + negated classes, so they are themselves linear-time (no self-ReDoS).
• Detects nested unbounded quantifiers by tracking group spans, escape- and char-class-aware.
• Line-cited via hunk headers, mirroring the actions-pin analyzer. Findings are bounded (MAX_FINDINGS, per-line length guard); the reported pattern is truncated and rendered through safeCodeSpan (public-safe — no matched value echoed).

Files (all inside review-enrichment/, per the established analyzer pattern)

• src/types.ts — RedosFinding type + redos BriefFindings key
• src/analyzers/redos.ts — the analyzer (pure helpers + scanRedos entrypoint)
• src/brief.ts — registered in the ANALYZERS registry
• src/render.ts — public-safe brief block
• test/enrichment.test.ts — detector unit tests, line-cited scan, entrypoint cap, render sanitization, and a buildBrief integration test

Validation

• npm test (build + node --test) inside review-enrichment/: 43/43 pass (5 new).
• git diff --check clean; engine src/** untouched (outside the engine tsc/vitest/codecov scope — zero conflict).

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[loopover-orb]

Tip

🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩

✅ Gittensory review — safe to merge

5 files · 1 AI reviewers · no blockers · readiness 55/100 · CI green · clean

✅ Approved — safe to merge

Review summary
Clean, well-scoped analyzer addition. The linear hand-scanner in `extractRegexSources` correctly sidesteps self-ReDoS (the central design constraint), the structural `hasCatastrophicBacktracking` detector correctly handles escapes, char classes, bounded `{n,m}` quantifiers, and nested groups, and wiring through `brief.ts`/`render.ts`/`types.ts` follows the established analyzer pattern exactly. Two issues — one a meaningful false-negative class, one a subtle false-positive edge case in the `{,}` quantifier path — are worth tightening before ship.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewers, synthesized
Linked issue	✅ Linked	#1503
Related work	⚠️ 3 scoped overlaps	Top overlaps are listed below; lower-confidence bulk is hidden.
Review load	❌ 8/20	Readiness component derived from cached public PR metadata and labels; size label size:L.
Validation evidence	❌ 5/25	Cached preflight status is hold.
Open PR queue	❌ 3/10	24 open PR(s), 10 likely reviewable, 14 unlinked.
Contributor context	✅ Confirmed Gittensor contributor	oktofeesh1; Gittensor profile; 891 PR(s), 8 issue(s).
Gate result	✅ Passing	No configured blocker found.

Nits — 5 non-blocking

• redos.ts:36 (`REGEX_POSITION_PREFIX`) — `isRegexPosition` returns false whenever a keyword's terminal word-char immediately precedes `/`, so `return /(a+)+/g`, `case /(\w+\.)+/`, `typeof /pat/`, and `throw /pat/` are silently skipped; those are valid regex positions and represent a meaningful false-negative class. Fix: add a backwards word-scan — if the run of word-chars ending at `slash-1` forms a JS regex-position keyword (`return`, `case`, `typeof`, `in`, `instanceof`, `void`, `delete`, `throw`, `new`, `of`), return true.
• redos.ts:148 (`unboundedQuantifierAt`) — the inline `/^\{\d*,\}/.test(p.slice(i))` matches `{,}` (zero digits before the comma) because `\d*` allows an empty match; in non-Unicode JS `{,}` is treated as literal characters, not a quantifier, so `(a{,})+` would be falsely flagged. Change `\d*` to `\d+` (or hand-scan: consume at least one digit, then `,`, then `}`) to require a numeric lower bound.
• test/enrichment.test.ts — no test drives `extractRegexSources` or `scanPatchForRedos` against a line of the form `return /(a+)+/g`, so the keyword false-negative above is invisible to the suite; add one assertion to surface the gap, even if it is left as a known limitation with a comment.
• redos.ts:148 — replace the regex + slice with a hand-scan consistent with the file's own design rationale and fixing the `{,}` false positive: ```ts if (c === '{') { let k = i + 1; while (k < p.length && p[k] >= '0' && p[k] <= '9') k++; return k > i + 1 && p[k] === ',' && p[k + 1] === '}'; } ```
• redos.ts:36 — extend `isRegexPosition` to cover keyword-ending word-chars with a bounded backwards scan: ```ts if (isWordChar(before)) { let k = slash - 1; while (k > 0 && isWordChar(line[k - 1]!)) k--; const kw = line.slice(k, slash); const REGEX_KWS = new Set(['return','case','typeof','in','instanceof','void','delete','throw','new','of']); return REGEX_KWS.has(kw); } ```

Review context

• Author: oktofeesh1
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: not available
• Official Gittensor activity: 891 PR(s), 8 issue(s).
• Related work: Items reference the same linked issue feat(enrichment): ReDoS scanner on added/changed regex #1503. (issue #1503)
• Related work: Open PR work references issue feat(enrichment): ReDoS scanner on added/changed regex #1503. (issue #1503)
• Related work: Items reference the same linked issue MCP CLI: add PowerShell shell completion #1452. (issue #1452, PR #1448)
• Additional title-only matches omitted; title-only overlap does not block.

Contributor next steps

• Review top overlaps.
• Add scope summary.
• Fix blocker.
• Expect slower review.
• Refresh registry data or choose a registered active repo.
• Check active issues and PRs before submitting.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Review load = cached public PR metadata such as size labels, changed paths, and preflight status.
• Open PR queue = repo-wide review pressure; it is not a PR quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

Review details

Generated from public PR metadata and the diff. Advisory only; deterministic signals remain authoritative.

Clean, well-scoped analyzer addition. The linear hand-scanner in `extractRegexSources` correctly sidesteps self-ReDoS (the central design constraint), the structural `hasCatastrophicBacktracking` detector correctly handles escapes, char classes, bounded `{n,m}` quantifiers, and nested groups, and wiring through `brief.ts`/`render.ts`/`types.ts` follows the established analyzer pattern exactly. Two issues — one a meaningful false-negative class, one a subtle false-positive edge case in the `{,}` quantifier path — are worth tightening before ship.

Nits (5)

• redos.ts:36 (`REGEX_POSITION_PREFIX`) — `isRegexPosition` returns false whenever a keyword's terminal word-char immediately precedes `/`, so `return /(a+)+/g`, `case /(\w+\.)+/`, `typeof /pat/`, and `throw /pat/` are silently skipped; those are valid regex positions and represent a meaningful false-negative class. Fix: add a backwards word-scan — if the run of word-chars ending at `slash-1` forms a JS regex-position keyword (`return`, `case`, `typeof`, `in`, `instanceof`, `void`, `delete`, `throw`, `new`, `of`), return true.
• redos.ts:148 (`unboundedQuantifierAt`) — the inline `/^\{\d*,\}/.test(p.slice(i))` matches `{,}` (zero digits before the comma) because `\d*` allows an empty match; in non-Unicode JS `{,}` is treated as literal characters, not a quantifier, so `(a{,})+` would be falsely flagged. Change `\d*` to `\d+` (or hand-scan: consume at least one digit, then `,`, then `}`) to require a numeric lower bound.
• test/enrichment.test.ts — no test drives `extractRegexSources` or `scanPatchForRedos` against a line of the form `return /(a+)+/g`, so the keyword false-negative above is invisible to the suite; add one assertion to surface the gap, even if it is left as a known limitation with a comment.
• redos.ts:148 — replace the regex + slice with a hand-scan consistent with the file's own design rationale and fixing the `{,}` false positive: ```ts if (c === '{') { let k = i + 1; while (k < p.length && p[k] >= '0' && p[k] <= '9') k++; return k > i + 1 && p[k] === ',' && p[k + 1] === '}'; } ```
• redos.ts:36 — extend `isRegexPosition` to cover keyword-ending word-chars with a bounded backwards scan: ```ts if (isWordChar(before)) { let k = slash - 1; while (k > 0 && isWordChar(line[k - 1]!)) k--; const kw = line.slice(k, slash); const REGEX_KWS = new Set(['return','case','typeof','in','instanceof','void','delete','throw','new','of']); return REGEX_KWS.has(kw); } ```

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review