perf(redact): eliminate exponential backtracking (ReDoS) in config-key patterns - #76083
Merged
kshitijk4poor merged 3 commits intoAug 1, 2026
Conversation
_CFG_DOTTED_RE's nested quantifier (?:[A-Za-z0-9_\-]+\.)+ backtracks exponentially on long non-matching dotted runs (doubles every ~4 segments). Flatten it and use possessive quantifiers (py3.11+) in _CFG_DOTTED_RE and _YAML_ASSIGN_RE wherever the successor is disjoint. Zero behavior change: equivalence fuzz-verified over 120k structured and random inputs comparing full sub() output including groups. Adds a ReDoS regression test.
- Relax timing bound from 1.0s to 2.0s (CI machine robustness). - Add test_long_dotted_run_with_keyword_completes_fast: includes a secret keyword so the pre-gate does NOT skip _CFG_DOTTED_RE — directly exercises the possessive-quantifier regex, not just the pre-gate. - Add test_yaml_assign_redos_resistance: _YAML_ASSIGN_RE was modified but had no ReDoS test — add 100-line stress input. - Add test_yaml_assign_secret_still_redacted: verify YAML matching behavior preserved with possessive quantifiers.
Required for check-attribution CI on salvage PR NousResearch#76083.
kshitijk4poor
enabled auto-merge (rebase)
August 1, 2026 10:27
alt-glitch
added
type/perf
louisgreen0726
pushed a commit
to louisgreen0726/hermes-agent
that referenced
this pull request
Aug 7, 2026
Required for check-attribution CI on salvage PR NousResearch#76083.
randlee
pushed a commit
to randlee/hermes-agent
that referenced
this pull request
Aug 11, 2026
Required for check-attribution CI on salvage PR NousResearch#76083.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Eliminates exponential backtracking (ReDoS) in
agent/redact.pyconfig-key regexes by replacing nested quantifiers with Python 3.11+ possessive quantifiers.Changes
agent/redact.py:_CFG_DOTTED_REand_YAML_ASSIGN_RErewritten with possessive quantifiers (*+,++) wherever the successor character class is disjoint, preventing catastrophic backtracking on long dotted runs.tests/agent/test_redact.py: 5 ReDoS resistance tests (3 from contributor + 2 added during salvage).Why
redact_sensitive_text()runs on every log line and transcript chunk. A hostile or unlucky log line containing a long dotted run could pin a core and stall the redaction pipeline. Old pattern was O(2^(n/4)); new is O(n).Salvage notes
Cherry-picked from #68086 by @carlotestor (authorship preserved). Follow-up commit adds:
test_long_dotted_run_with_keyword_completes_fast— the contributor's test used "segment" tokens (no secret keyword), so the keyword pre-gate on main skips_CFG_DOTTED_REentirely. This new test includes "token" so the regex is directly exercised.test_yaml_assign_redos_resistance+test_yaml_assign_secret_still_redacted—_YAML_ASSIGN_REwas modified but had no ReDoS test.Validation
Closes #68086
/cc @carlotestor