add two test cases that demonstrate the limits of the suffix construction

erik-krogh · erik-krogh · commit e177d46c0af4 · 2020-11-27T13:45:34.000+01:00
diff --git a/javascript/ql/test/query-tests/Performance/ReDoS/ReDoS.expected b/javascript/ql/test/query-tests/Performance/ReDoS/ReDoS.expected
@@ -121,3 +121,5 @@
 | tst.js:299:90:299:91 | e+ | This part of the regular expression may cause exponential backtracking on strings starting with '00000000000000' and containing many repetitions of 'e'. |
 | tst.js:302:18:302:19 | c+ | This part of the regular expression may cause exponential backtracking on strings starting with 'ab' and containing many repetitions of 'c'. |
 | tst.js:305:18:305:20 | \\s+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of ' '. |
+| tst.js:308:16:308:24 | ([^/]\|X)+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'X'. |
+| tst.js:311:20:311:24 | [^Y]+ | This part of the regular expression may cause exponential backtracking on strings starting with 'x' and containing many repetitions of 'Xx'. |
diff --git a/javascript/ql/test/query-tests/Performance/ReDoS/tst.js b/javascript/ql/test/query-tests/Performance/ReDoS/tst.js
@@ -303,3 +303,9 @@ var bad66 = /^ab(c+)+$/;
 
 // NOT GOOD
 var bad67 = /(\d(\s+)*){20}/;
+
+// GOOD - but we spuriously conclude that a rejecting suffix exists. 
+var good36 = /(([^/]|X)+)(\/[^]*)*$/;
+
+// GOOD - but we spuriously conclude that a rejecting suffix exists. 
+var good37 = /^((x([^Y]+)?)*(Y|$))/;
