From 36af6b721175a6bb1c0fe40efea1c79df1cea19d Mon Sep 17 00:00:00 2001
From: garrytan <garrytan@gmail.com>
Date: Mon, 2 Nov 2026 02:15:07 +0000
Subject: [PATCH] fix(review-risk): the R51 rm and rmSync rules run in linear
 time (GST-898)

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
---
 changelog.d/gst-898-rm-rule-redos.md | 2 ++
 lib/review-risk.ts                   | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)
 create mode 100644 changelog.d/gst-898-rm-rule-redos.md

diff --git a/changelog.d/gst-898-rm-rule-redos.md b/changelog.d/gst-898-rm-rule-redos.md
new file mode 100644
index 000000000..eb4b26132
--- /dev/null
+++ b/changelog.d/gst-898-rm-rule-redos.md
@@ -0,0 +1,2 @@
+- **One hostile line no longer stalls review classification** (GST-898). R51's `rm -rf` rule in `lib/review-risk.ts` took quadratic time on a long flag run: one added line of `rm -` and 100,000 `r` characters held `matchRisk` for about 3.7 s, and each doubling took four times as long. The `rmSync(… recursive: true)` rule did the same on a line of repeated `rmSync(` calls. Both now run in linear time (the same line takes about 1 ms). The `rm` rule is rewritten with lookaheads and matches exactly the lines it matched before, checked against 60,000 seeded lines. The `rmSync` rule now looks at most 500 characters into the call, the bound GST-850 uses. A slow match never lowered review depth: `gstack-review-dispatch pass` stops when the plan times out, and the queue recomputes depth itself.
+- A new test holds every risk pattern under 100 ms on 100,000-character hostile lines. Over the last 100 main commits, no commit changes depth, class or risk class, and none of the 69,023 changed lines gets a different verdict from either rule.
diff --git a/lib/review-risk.ts b/lib/review-risk.ts
index 50b152edb..48b720e46 100644
--- a/lib/review-risk.ts
+++ b/lib/review-risk.ts
@@ -37,7 +37,7 @@ export const SECURITY_LINE = [
   /\bshell\s*:\s*true\b/, /\bshell\s*=\s*True\b/, /(?<![.\w])execSync\s*\(/, /\bchild_process\.exec(?:Sync)?\s*\(/, /\bos\.system\s*\(/,
   /(?<![.\w])eval\s*\(/, /(?:^|[;&|])\s*eval\s+["'$]/, /\bnew\s+Function\s*\(/,
   /\b(?:spawn|spawnSync|execFile|execFileSync)\s*\(\s*['"](?:\/bin\/)?(?:ba|z)?sh['"]/, /\bBun\.spawn(?:Sync)?\s*\(\s*\[\s*['"](?:\/bin\/)?(?:ba|z)?sh['"]/,
-  /\brmSync\s*\([^)]*recursive\s*:\s*true/, /\brm\s+-(?:[a-z]*r[a-z]*f|[a-z]*f[a-z]*r)\b/,
+  /\brmSync\s*\([^)]{0,500}recursive\s*:\s*true/, /\brm\s+-(?=[a-z]*r)(?=[a-z]*f)[a-z]*[rf]\b/,
   /\b(?:innerHTML|outerHTML)\s*\+?=/, /\bdangerouslySetInnerHTML\b/, /\bv-html\b/, /\{@html\b/, /\binsertAdjacentHTML\s*\(/, /\bdocument\.write\s*\(/,
 ];
 const DATA_PATH_TOKENS = ['pii', 'gdpr', 'ccpa', 'privacy', 'personal', 'account', 'accounts', 'customer', 'customers', 'cookie', 'cookies', 'persistence', 'storage', 'database'];