Improve S5332 performance: Reuse compiled regex

[martin-strecker-sonarsource]

The 5 compiled regex used in ClearTextProtocolsAreSensitive are not cached between instances and are adding a significant JIT compilation overhead. This PR fixes this:

Time spend on compiling

akka.net project

Before:

After:

Overall

Before: 18th most expensive operation with 14,5 seconds

After: 55 ms

[andrei-epure-sonarsource]

LGTM.

Please address the SC failed QG before merging.

[andrei-epure-sonarsource]

regarding the https://rules.sonarsource.com/csharp/RSPEC-3963/

I've marked it as FP after a discussion with @martin-strecker-sonarsource :

It is an FP because you can not move the logic to field initializers as suggested. It requires SE to figure this out because you have to look at the code flow (one variable is used to initialize more than one field).

@denis-troller open question whether we want to turn this rule into a Symbolic Execution rule, to avoid False Positives and only raise if the fix is doable

[andrei-epure-sonarsource]

On the other hand, couldn't you replace with

        private static readonly Lazy<string> ValidServerPattern = new Lazy<string>(() =>
        {
            const string allSubdomainsPattern = @"([^/?#]+\.)?";

            var domainsList = LocalhostAddresses
                .Concat(CommonlyUsedXmlDomains)
                .Select(Regex.Escape)
                .Concat(CommonlyUsedExampleDomains.Select(x => allSubdomainsPattern + Regex.Escape(x)));

            return domainsList.JoinStr("|");
        });
        private static readonly Regex HttpRegex = CompileRegex(@$"^http:\/\/(?!{ValidServerPattern.Value}).");
        private static readonly Regex FtpRegex = CompileRegex(@$"^ftp:\/\/.*@(?!{ValidServerPattern.Value})");
        private static readonly Regex TelnetRegex = CompileRegex(@$"^telnet:\/\/.*@(?!{ValidServerPattern.Value})") ;
        private static readonly Regex TelnetRegexForIdentifier = CompileRegex(@"Telnet(?![a-z])", false);
        private static readonly Regex ValidServerRegex = CompileRegex($"^({ValidServerPattern.Value})$");

[martin-strecker-sonarsource]

This would work (even without the Lazy). I explicitly did not do it, as re-ordering the members would break the logic at runtime. Reordering in the static constructor breaks at compile time.

See also this comment for the same problem but for object initializers:

All that said, it really shouldn't matter. If you have a class where the order of assignments to two or more properties affects the final outcome, you've got a pretty hazardous class on your hands. Such design ought to be avoided at all costs, as it is way too easy to break in any case, even when the compiler rules for object initialization are reasonably clear.

https://stackoverflow.com/a/47959273

Or this one by John Skeet:

I would also be very wary of actually writing code which depends on this..

https://stackoverflow.com/a/495622

[andrei-epure-sonarsource]

On the other hand, couldn't you replace with

        private static readonly Lazy<string> ValidServerPattern = new Lazy<string>(() =>
        {
            const string allSubdomainsPattern = @"([^/?#]+\.)?";

            var domainsList = LocalhostAddresses
                .Concat(CommonlyUsedXmlDomains)
                .Select(Regex.Escape)
                .Concat(CommonlyUsedExampleDomains.Select(x => allSubdomainsPattern + Regex.Escape(x)));

            return domainsList.JoinStr("|");
        });
        private static readonly Regex HttpRegex = CompileRegex(@$"^http:\/\/(?!{ValidServerPattern.Value}).");
        private static readonly Regex FtpRegex = CompileRegex(@$"^ftp:\/\/.*@(?!{ValidServerPattern.Value})");
        private static readonly Regex TelnetRegex = CompileRegex(@$"^telnet:\/\/.*@(?!{ValidServerPattern.Value})") ;
        private static readonly Regex TelnetRegexForIdentifier = CompileRegex(@"Telnet(?![a-z])", false);
        private static readonly Regex ValidServerRegex = CompileRegex($"^({ValidServerPattern.Value})$");

[sonarqubecloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
No Duplication information

[sonarqubecloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

100.0% Coverage
0.0% Duplication

[andrei-epure-sonarsource]

LGTM