Repository navigation
Match repository patterns in linear time, and refuse a timed-out match [patch] - #113
Merged
Merged
Conversation
…h [patch] A pattern with two stars in one segment, such as team/*-svc-*, became adjacent [^/]* runs that the backtracking engine took polynomial time to reject. The allow-list runs before admission, so an unauthenticated long path could time the match out and get a 500. The expression is now built with RegexOptions.NonBacktracking, and a match that still times out counts as not allowed. Fixes #111 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017vfJW6ERvyATBYDH9pPgb7
Adds an internal TryParse overload that takes the match timeout, so a test can make a match time out and check that Matches reads it as not allowed rather than throwing. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017vfJW6ERvyATBYDH9pPgb7
Contributor
Author
|
I've re-run the failed job once. The 52e9328 commit also adds a test for the timed-out match path, which addresses SonarCloud's earlier 50% new-code coverage failure on 3370d8e. Generated by Claude Code |
|
This was referenced Nov 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #111
What changes
GitBranchStateCache/Upstreams/RepositoryPattern.cs:RegexOptions.NonBacktracking, so matching time is linear in the path whatever the pattern. A pattern with two stars in one segment (team/*-svc-*) no longer backtracks polynomially on a long segment that can't match. Case-insensitive, culture-invariant matching and the anchoring are unchanged.MatchescatchesRegexMatchTimeoutExceptionand returnsfalse. Even if the 100 ms guard ever fires,IsAllowedthen fails andBranchStateHandler.Resolvereturns its existing 404no-such-repository, never an unhandled 500.I didn't move the segment-length check ahead of the allow-list. With linear matching it isn't needed for this issue, and it would change the order of 404 reasons, which is a separate decision.
Tests
In
RepositoryPatternTests:Matches_SeveralStarsInOneSegment_RejectsALongNonMatchingPathWithoutTimingOutrunsstudio/*-*-*against 1000 dashes,studio/*-*against 4000 dashes, andteam/*-svc-*against 4000 dashes. After a warm-up match, each must returnfalsein under 50 ms.Matches_SeveralStarsInOneSegment_StillMatchesWhatItShouldchecks that a multi-star pattern still matches, case-insensitively, and still respects segment boundaries.With the source change reverted, the
studio/*-*-*andstudio/*-*rows fail: the match times out after about 100 ms and throws. With it applied, the fullGitBranchStateCache.Testssuite passes on net10.0.Generated by Claude Code