open/llm-ingestion-pipeline-security
1
0
Fork 0
Code Issues Releases 1 Activity

test(redos): the lexicon-iframe-src row already discriminates at the shared N

Browse source 
Measured both directions at _REDOS_N=100_000: shipped [^><] 0.375s,
vulnerable [^>] 8.95s -- ~24x apart, both ~4-5x clear of the 2.0s bound.
Unlike lexicon-script-tag, no per-row override was needed; recorded the
margin so a future reader can tell the absence of an override here is
measured, not an oversight.
This commit is contained in:
Kjell Tore Guttormsen 2026-08-11 21:52:04 +02:00
commit 1d49f83a61
1 changed files with 3 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
tests/test_output.py
View file

@ -408,6 +408,9 @@ _REDOS_PAYLOADS = [
# (~3.7s at 200k) while the shipped `[^><]` form stays at ~0.8s. 200_000
# is this row's own override, not the shared _REDOS_N.
("lexicon-script-tag", scan_lexicon, "<script ", 200_000),
# Unlike script-tag, this row is not marginal at the shared _REDOS_N: measured
# both directions at 100_000 -- shipped `[^><]` 0.375s, vulnerable `[^>]` 8.95s
# (~24x apart, both ~4-5x clear of the 2.0s bound). No per-row override needed.
("lexicon-iframe-src", scan_lexicon, "<iframe "),
]