Repository navigation
RegExpInjection takes 6 hours to scan the TypeScript repo after 2.20.2 #18584
Description
Description of the issue
The GitHub hosted runners switched from 2.20.1 to 2.20.2, and now the RegExpInjection rule takes 6ish hours on the TypeScript repo.
Before: https://github.com/microsoft/TypeScript/actions/runs/12920012966/job/36031579264
[80/90] Loaded /opt/hostedtoolcache/CodeQL/2.20.1/x64/codeql/qlpacks/codeql/javascript-queries/1.2.6/Security/CWE-730/RegExpInjection.qlx.
[89/90 eval 2m9s] Evaluation done; writing results to codeql/javascript-queries/Security/CWE-730/RegExpInjection.bqrs.
After: https://github.com/microsoft/TypeScript/actions/runs/12937825177/job/36086609739?pr=61034
[62/90] Loaded /opt/hostedtoolcache/CodeQL/2.20.2/x64/codeql/qlpacks/codeql/javascript-queries/1.3.0/Security/CWE-730/RegExpInjection.qlx.
[90/90 eval 317m7s] Evaluation done; writing results to codeql/javascript-queries/Security/CWE-730/RegExpInjection.bqrs.
I suspect this is due to the TypeScript compiler generating RegExp instances at runtime in order to implement file globbing; their inputs are technically from user input, but it's parsed out and constructed from known syntax with limitations. Even if these were poorly constructed, this is not a security problem; it just make's a user's own compilation slow.
The changelog for 2.20.2 mentions this, so it's possible the analysis is running away.
Activity
jakebailey commentedon Jan 24, 2025
What I see is a lot of:
hvitved commentedon Jan 24, 2025
@github/codeql-javascript : Can you take a look, please?
asgerf commentedon Jan 24, 2025
Thanks for the report!
This seems to be consequence of our recent switch to the same data flow library used by other languages. There are rare cases where this type of slowdown can occur and we're looking into ways to fix it, but for now I've added this reproduction case to our internal tracking issue.
In the meantime, your workaround makes sense, especially if you don't consider regexp injection to be a security issue in this repository.
maschwenk commentedon Jan 28, 2025
Filed a similar Issue for
js/weak-cryptographic-algorithm. Unsure if same root cause but started happening the same day.Thanks for taking the taking the time to report the original @jakebailey ! inspired me to do the same
js/weak-cryptographic-algorithm/BrokenCryptoAlgorithmgot 25-30x slower #18604nite-knite commentedon Feb 7, 2025
Our project encountered the same issue. It took over 2.5 hours to complete the detection of the
RegExpInjectionrule.Here is one of the runs in case you’re still looking for public cases. @asgerf
https://github.com/langgenius/dify/actions/runs/13181386937/job/36792777939
hvitved commentedon Aug 24, 2026
A fix has now been merged, which will be included in the 2.27.0 release, so I'll close this issue. Thanks for your patience.