Branch: refs/heads/master Home: https://github.com/xwiki/xwiki-platform Commit: 1cbbd138c1d0aa39dc0ba384b54340a6d18efb42 https://github.com/xwiki/xwiki-platform/commit/1cbbd138c1d0aa39dc0ba384b5434... Author: Vincent Massol <[email protected]> Date: 2026-08-26 (Wed, 26 Aug 2026) Changed paths: M xwiki-platform-core/xwiki-platform-csrf/src/test/java/org/xwiki/csrf/DefaultCSRFTokenTest.java M xwiki-platform-tools/xwiki-platform-tool-standards-validator/src/main/java/org/xwiki/validator/HTML5DutchWebGuidelinesValidator.java Log Message: ----------- [Misc] Simplify two regular expressions that backtrack super-linearly (SonarQube) (#6232) * java:S8786: the CSRF token check matched ".*[bad chars].*" against the whole token, and the email pattern of the Dutch web guidelines validator chained two unbounded quantifiers over overlapping character sets ("([\.\w])+[\w]+"). Both backtrack quadratically on a non-matching input. The token check now looks for the bad characters with find() instead of wrapping them in ".*", and the local part of the email is matched by "[\w-][.\w]+\w", which accepts exactly the same strings. * java:S5998: the domain part "([\w-]+\.)+" is a group repetition, which Java's regex engine implements recursively and can therefore overflow the stack on a long input. Making the group atomic keeps the same language while letting each iteration leave no backtracking state behind. Co-authored-by: Claude Opus 5 (1M context) <[email protected]> To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-platform/settings/notifications