Skip to content

fix: avoid polynomial regex in routes annotation stripping - #1

Open
devin-ai-integration[bot] wants to merge 2 commits into
activerecord_8_supportfrom
devin/1794281262-fix-routes-redos
Open

devin-ai-integration[bot] wants to merge 2 commits into
activerecord_8_supportfrom
devin/1794281262-fix-routes-redos

Conversation

@devin-ai-integration

Copy link
Copy Markdown

Summary

Fixes code-scanning alert rb/polynomial-redos #1. AnnotateRoutes::Helpers.strip_annotations decided whether a line was still part of the route-map header with the unanchored line !~ /\s*#/, which backtracks quadratically on long whitespace runs. That regex matches exactly when the line contains #, so it becomes !line.include?('#'). The behaviour stays the same.

Adds a spec for header stripping and a long whitespace line. Ran it with the existing annotate_routes_spec.rb on Ruby 3.4 using a temporary Gemfile, because the repo's Ruby 2.7 toolchain wasn't available: 87 examples passed.

Link to Devin session: https://app.devin.ai/sessions/a9787919a905463b8434939e6587f7fe
Open in Devin Desktop: https://app.devin.ai/desktop/session/a9787919a905463b8434939e6587f7fe?variant=devin

Co-Authored-By: adam@nexl.cloud <addbv2@hotmail.com>
Copilot AI balanced review requested due to automatic review settings November 10, 2026 03:29
@devin-ai-integration

Copy link
Copy Markdown
Author

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

  • Disable automatic comment, CI, and merge conflict monitoring

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

No active review issues are identified for the route annotation stripping change.

No open issues 🎉

What changed in this PR

Addresses the polynomial-regex code-scanning alert in route annotation stripping while preserving existing behavior.

Changes:

  • Replaces the unanchored regex with a direct # substring check.
  • Adds specs for header removal and a long whitespace-only line, including an execution-time limit.
File Description
spec/​lib/​annotate/​annotate_routes/​helpers_spec.rb Adds functional and performance-regression coverage for annotation stripping.
lib/​annotate/​annotate_routes/​helpers.rb Uses include? to avoid regex backtracking when detecting the header boundary.

Review effort: Balanced

Co-Authored-By: adam@nexl.cloud <addbv2@hotmail.com>
Copilot AI balanced review requested due to automatic review settings November 10, 2026 03:30

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

No active review issues remain for the change replacing regex matching with a literal # check in route annotation stripping.

No open issues 🎉

Review effort: Balanced

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant