Skip to content

Add ReDoS regression tests for 6 languages with zero current coverage (haskell, kotlin, lua, ruby, scala, swift) #1070

Closed

Description

@squid-protocol

Issue

Six languages in tests/extraction/languages/ have literal zero ReDoS regression testing in their _strict.py files: haskell, kotlin, lua, ruby, scala, swift. Verified by grep -c for assert_redos_immune calls in each file.

This is a critical gap: an O(n²) backtracking bug in any of these languages' regex rules would go undetected. The shared test harness in tests/extraction/languages/_strict_harness.py provides the _best_of_timing method (geometric-growth payload scaling) which is the stronger ReDoS test than single-timeout checks.

Solution

For each of these 6 languages:

  1. Add at least one _best_of_timing scaling-ratio test per language covering the most complex quantifier shapes in that language's regex rules (those most likely to exhibit O(n²) backtracking).
  2. Prioritize rules with nested quantifiers, alternation with overlapping prefixes, or unbounded character classes (the recurring bug classes identified in epic Epic: Strict & exact regex test coverage for all structural signatures, per language #518).
  3. Reference tests/extraction/languages/_strict_harness.py for the _best_of_timing(candidate_regex, pathological_case_list, ...) signature and existing usage in languages like c, cpp, csharp for examples.

Files to modify

  • tests/extraction/languages/test_haskell_strict.py
  • tests/extraction/languages/test_kotlin_strict.py
  • tests/extraction/languages/test_lua_strict.py
  • tests/extraction/languages/test_ruby_strict.py
  • tests/extraction/languages/test_scala_strict.py
  • tests/extraction/languages/test_swift_strict.py

Related issues

Activity

  1. added
    testingUnit, integration, and E2E pipeline verification
    core-engineModifications to the central physics and parsing engine
    on Aug 5, 2026
  2. added this to the v2.4.8 milestone on Aug 16, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    core-engineModifications to the central physics and parsing enginetestingUnit, integration, and E2E pipeline verification

    Projects

    No projects

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions