Add rule SXXX: RegEx evaluation should have a time out specified

[Corniel]

Replaced by #1188

Ad proposed the Sonarsource community and implemented here: Sonar .NET.

I hope this PR actually helps the process, otherwise, my apologies.

[martin-strecker-sonarsource]

Related or possible duplicates

• Backtracking and DoS https://sonarsource.github.io/rspec/#/rspec/S2631
• Using regular expressions is security-sensitive https://sonarsource.github.io/rspec/#/rspec/S4784
• Using slow regular expressions is security-sensitive https://sonarsource.github.io/rspec/#/rspec/S5852/csharp

A lot of the rules are mentioning backtracking as a root for stack overflows or non-linear execution time problems. .Net 7 adds a NonBacktracking option to avoid this. See also https://devblogs.microsoft.com/dotnet/regular-expression-improvements-in-dotnet-7/#backtracking-and-regexoptions-nonbacktracking

We may consider RegexOptions.NonBacktracking as a valid alternative to specifying a timeout (more research is needed, though).

[Corniel]

@martin-strecker-sonarsource Already decided which one to go for? I think S5852 is an duplicate of S4784. I think it is up to you who to merge on an another.

[martin-strecker-sonarsource]

Hi @Corniel,

Working on the specification is a team effort, and we need to dedicate some time in our sprints to it. I will prepare as much as I can for the moment (tasks like looking for duplicates and so on), and I will drive the specification. Thanks to your work, we are already in a well-advanced state, but it will take some time to get this through the whole process.

[Corniel]

Working on the specification is a team effort, and we need to dedicate some time in our sprints to it. I will prepare as much as I can for the moment (tasks like looking for duplicates and so on), and I will drive the specification. Thanks to your work, we are already in a well-advanced state, but it will take some time to get this through the whole process.

That is totally understandable. Take your time. I hope the current state can be shipped before the part that evaluates the regex is also taken into account, but that is a call your team should make.

[martin-strecker-sonarsource]

Replaced by #1188
Thank you @Corniel for the blueprint. I created a new PR to get a new rule id and copied the content over.