fix(helpers): escape literal . in ASCII-section regex

[snicket2100]

Fixes #7475.

Fixes an exponential-blowup bug in responsehighlighter.highlightAsciiSection that hangs nuclei and OOMs the process within seconds whenever debug output is enabled for a network template whose matched response contains non-printable bytes, AND ≥2 matched binary fragments end up in OperatorsResult.Matches.

Proof

Steps to reproduce from #7475 don't longer result in nuclei entering an infinite loop.

Checklist

• Pull request is created against the dev branch
• All checks passed (lint, unit/integration/regression tests etc.) with my changes
• I have added tests that prove my fix is effective or that my feature works
• I have added necessary documentation (if appropriate)

Summary by CodeRabbit

Release Notes

• Bug Fixes

  • Fixed hexdump response highlighting behavior for non-ASCII-printable characters.

• Tests

  • Added test to detect potential performance regressions in hexdump response highlighting.

[coderabbitai]

Walkthrough

A one-character regex fix in highlightAsciiSection changes the per-character match pattern for non-ASCII-printable runes from an unescaped dot (".") to an escaped dot ("\.") when building snippetCharactersMatchPattern, preventing catastrophic backtracking. A regression test is added to verify the call completes within 5 seconds and produces output under 10,000 bytes.

Changes

Hex dump regex catastrophic backtracking fix

Layer / File(s)	Summary
Escaped dot fix and regression test pkg/protocols/common/helpers/responsehighlighter/hexdump.go, pkg/protocols/common/helpers/responsehighlighter/response_highlighter_test.go	highlightAsciiSection now emits \. instead of . for non-ASCII-printable characters in the regex snippet pattern, preventing catastrophic backtracking with multi-match inputs. TestHexDumpHighlightDoesNotExplode runs Highlight in a goroutine with a 5-second time.After timeout and asserts the output stays under 10,000 bytes.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~5 minutes

Poem

A dot unescaped caused infinite dread,
Backtracking forever, consuming all thread.
One backslash added, the regex now still,
No memory explosion, no runaway drill.
The rabbit hops free — the bug's been outfoxed! 🐇✨

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Linked Issues check	✅ Passed	The PR fixes the exponential-blowup bug in highlightAsciiSection causing infinite memory consumption by escaping unescaped . characters in regex patterns, directly addressing issue #7475's requirements.
Out of Scope Changes check	✅ Passed	All changes are directly related to fixing the regex escaping bug: the main fix escapes literal dots, and the test verifies the hang/memory exhaustion no longer occurs.
Title check	✅ Passed	The title directly describes the primary fix: escaping literal . characters in the ASCII-section regex pattern, which is the core bug fix addressing the exponential-blowup issue.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[daviediao-code]

Reviewed this PR.

Assessment: Implementation looks solid and follows project conventions. Clean code quality.

Approved ✅

[dwisiswant0]

Thank you for your contributions, @snicket2100! Merging this.