github
diff --git a/‎javascript/ql/src/semmle/javascript/security/performance/SuperlinearBackTracking.qll‎
Lines changed: 1 addition & 1 deletion b/‎javascript/ql/src/semmle/javascript/security/performance/SuperlinearBackTracking.qll‎
Lines changed: 1 addition & 1 deletion
@@ -407,7 +407,7 @@ class PolynomialBackTrackingTerm extends InfiniteRepetitionQuantifier {
   PolynomialBackTrackingTerm() {
     reason = getReasonString(this, pump, prefixMsg, prev) and
     // there might be many reasons for this term to have polynomial backtracking - we pick an arbitary one.
-    reason = min(string msg | msg = getReasonString(this, _, _, _))
+    reason = min(string msg | msg = getReasonString(this, _, _, _) | msg order by msg.length(), msg)
   }
 
   /**
Original file line number	Diff line number	Diff line change
`@@ -407,7 +407,7 @@ class PolynomialBackTrackingTerm extends InfiniteRepetitionQuantifier {`
`407`	`407`	`PolynomialBackTrackingTerm() {`
`408`	`408`	`reason = getReasonString(this, pump, prefixMsg, prev) and`
`409`	`409`	`// there might be many reasons for this term to have polynomial backtracking - we pick an arbitary one.`
`410`		`- reason = min(string msg \| msg = getReasonString(this, _, _, _))`
	`410`	`+ reason = min(string msg \| msg = getReasonString(this, _, _, _) \| msg order by msg.length(), msg)`
`411`	`411`	`}`
`412`	`412`
`413`	`413`	`/**`