GeezerVison

`GitConfigParser.OPTCRE` matched an option line with
`(?P<option>[^:=#;]*)` immediately followed by `\s*(?P<vi>[:=])`. The
option name class and that `\s*` both match spaces, so a line that never
reaches a `:` or `=` separator (a key followed by a long run of
whitespace) makes the regex engine retry every space position, taking
`O(n^2)` time in the length of the run.

Config files are parsed straight from repository content. `.gitmodules`
in particular is read whenever submodules of an inspected or cloned
repository are enumerated, so the line is fully attacker-controlled. A
crafted key line costs about `0.25s` of CPU at 8,000 spaces and roughly
`160s` at 200,000, stalling any caller that reads the config.

The trailing `\s*` is redundant: `[^:=#;]*` already consumes any spaces
up to the indicator, and the captured name is right-stripped after
parsing. Dropping it leaves a single quantifier over the whitespace run,
so matching is linear. The collapsed pattern accepts exactly the same
lines and yields the same groups as the previous one, checked over
200,000 fuzzed inputs with zero differences.

Add `test_option_line_with_long_whitespace_run_is_not_quadratic`, a
CPU-time regression that fails on the previous pattern and passes here,
and that confirms a valid key before the malformed line still parses.

Copilot AI left a comment

Byron left a comment