Regex ReDoS Risk Analyzer

ReDoS is the freeze that shows up when a regular expression has to try an absurd number of paths before deciding that the text does not match. The analysis here is static: the expression is compiled only to check its syntax and then read character by character, marking suspect stretches by position. Nothing runs against generated input, so the tab is in no danger of locking up during the check.

The textbook case is ^(a+)+$. Against thirty letters a followed by an exclamation mark, the engine has to try every way of splitting those thirty letters between the two repetitions before it can answer no, and each extra letter doubles the count. Alternations such as (a|ab)* fall into the same hole, because both branches start with the same character and the engine cannot tell which one to use at each position.

The part that usually escapes notice is that anchoring with ^ and $ helps but does not cure: the anchor cuts the attempts at different starting positions and changes nothing inside the nested group. The fixes that survive a review are capping repetition with {1,50}, making alternation branches mutually exclusive, rejecting input above a size limit before the regex runs, and giving heavy validation a timeout.