Branch: refs/heads/misc-sonar-regex-backtracking Home: https://github.com/xwiki/xwiki-platform Commit: ab8eb4d711579475f81cf26c77db05b0d91decae https://github.com/xwiki/xwiki-platform/commit/ab8eb4d711579475f81cf26c77db0... Author: Vincent Massol <[email protected]> Date: 2026-08-26 (Wed, 26 Aug 2026) Changed paths: M xwiki-platform-core/xwiki-platform-csrf/src/test/java/org/xwiki/csrf/DefaultCSRFTokenTest.java M xwiki-platform-tools/xwiki-platform-tool-standards-validator/src/main/java/org/xwiki/validator/HTML5DutchWebGuidelinesValidator.java Log Message: ----------- [Misc] Simplify two regular expressions that backtrack super-linearly (SonarQube) * java:S8786: the CSRF token check matched ".*[bad chars].*" against the whole token, and the email pattern of the Dutch web guidelines validator chained two unbounded quantifiers over overlapping character sets ("([\.\w])+[\w]+"). Both backtrack quadratically on a non-matching input. The token check now looks for the bad characters with find() instead of wrapping them in ".*", and the local part of the email is matched by "[\w-][.\w]+\w", which accepts exactly the same strings. * java:S5998: the domain part "([\w-]+\.)+" is a group repetition, which Java's regex engine implements recursively and can therefore overflow the stack on a long input. Making the group atomic keeps the same language while letting each iteration leave no backtracking state behind. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-platform/settings/notifications