[Analyzer]: Flag non-productive uses of `RegexOptions.NonBacktracking`.

[teo-tsirpanis]

I have seen code like this in an online course:

partial class Regexes
{
    [GeneratedRegex("[^a-z]", RegexOptions.NonBacktracking)]
    public static partial Regex MyRegex { get; }
}

The regex is matched with the non-backtracking engine, with the justification of guaranteeing linear match times. However, the pattern is so trivial that it can be matched in linear time even without the non-backtracking engine, and in fact using it causes the generator to emit just a cached singleton, negating most of the benefits of source generation.

I propose an analyzer that indicates to the user that the use of RegexOptions.NonBacktracking for regexes that are not susceptible to catastrophically backtrack, will not bring any benefits and might actually decrease performance.

Questions

• How accurately can we detect patterns that are guaranteed to not exhibit catastrophic backtracking with the regular engine?
• Should we do this only in the source generator, or also in the Regex constructor with a constant pattern and options?
• If the user later changes their regex and it's no longer guaranteed to never catstrophically backtrack, they might not know that, and be susceptible to vulnerabilities. This might also necessitate another analyzer to suggest adding NonBacktracking or a timeout for such regexes, which I'm going to propose depending on the answer to the first question.

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/area-system-text-regularexpressions
See info in area-owners.md if you want to be subscribed.

[stephentoub]

I propose an analyzer that indicates to the user that the use of RegexOptions.NonBacktracking for regexes that are not susceptible to catastrophically backtrack, will not bring any benefits

Why? Someone is choosing the engine they want to use, it's not causing any problems, and they're explicitly saying "give me guardrails that ensure this runs in linear time". I don't want to dissuade them from that.

and might actually decrease performance.

Example?

[stephentoub]

I don't think this is something we need. Thanks, though.