ReDoS-safe @pattern: linear-time regex engine for constraint validation

[aaylward]

What

Closes #38 (broken out of the post-0.1.0 tracking issue #29): generated @pattern validation evaluated patterns with std::regex, a backtracking engine, so a catastrophic pattern like ^([0-9]+)+$ against a request-sized non-matching input could hang the server's dispatch thread (ReDoS). No C++ standard fixes this — std::regex has no complexity guarantee in C++20/23 and libstdc++ backtracks exponentially.

• smithy::Regex (smithy/core/regex.h, new in //runtime:core): a Thompson-NFA engine simulated breadth-first (Pike VM), O(pattern × input) for every pattern/input combination. Covers the ECMA-262 subset Smithy patterns use, over UTF-8 bytes with std::regex_search partial-match semantics: literals, ., character classes (ranges/negation/class escapes), \d \w \s &co, \xHH/\uHHHH, ^ $ \b \B, greedy+lazy quantifiers including {n,m}, groups (capturing/non-capturing/named), and alternation. Program size, repeat counts, and group nesting are capped; Outcome-based errors per ADR-0003. Zero new dependencies — hand-rolled per the owner's call after weighing RE2 (BCR) which would pull abseil-cpp into every consumer build.
• ValidationGenerator now emits smithy::Regex (fail-closed if a pattern were ever uncompilable at runtime) and rejects backreferences and lookaround at generation time — inherently backtracking constructs — with an error naming the pattern and the fix.
• Conformance: the authored jsonrpc2 suite grows @pattern coverage — JsonRpc2PatternMismatch (suite-exact ValidationException message with the pattern text) and JsonRpc2PatternReDoSInput (the catastrophic pattern must answer promptly; under the old engine this test hangs).
• Tests: engine unit suite (fixture patterns, anchors/classes/quantifiers/groups/boundaries, linearity checks on classic ReDoS bombs at 50k–100k input bytes, and a differential test against std::regex on random inputs), a regex fuzz harness (smoke-tested in every CI job, libFuzzer target under --config=fuzz), and a codegen unit test pinning the generation-time backreference rejection.
• Stale ReDoS notes removed: the exclusion-list comment and the server-guide "not yet generated" entry are replaced by the documented contract (server-guide Constraint-validation section, runtime.md module table).

Testing

• bazel test //... (minus benchmarks/Beast targets, whose archives this sandbox's proxy can't fetch — the documented exclusion): 64/64 pass, including the new core_test regex suite, regex_fuzz_smoke, and the regenerated jsonrpc2 malformed suite with the ReDoS case.
• (cd codegen && gradle build spotlessCheck) green, including the new rejectsBacktrackingOnlyPatterns plugin test.
• gradle generateFixtures generateProtocolTests output committed (weather + roundtrip/rest servers switch to smithy::Regex; jsonrpc2 regenerates with the new cases); regeneration is byte-identical for everything else.
• clang-format and clang-tidy clean on the new runtime files; buildifier clean on the BUILD edits.

Checklist

• Tests added/updated for the change (engine unit tests, fuzz harness, conformance cases, codegen rejection test)
• bazel test //... and (cd codegen && gradle build spotlessCheck) pass locally (Beast/benchmark targets excluded per docs — proxy blocks their archive fetches)
• Formatting clean (clang-format, clang-tidy, buildifier, spotless)
• Architectural decisions recorded as an ADR (not applicable — implements the documented Outcome/error conventions; no new dependency or interface contract beyond one runtime class)

🤖 Generated with Claude Code

https://claude.ai/code/session_01SyQAo21Pv6GYhHrkbQj8xQ

---

Generated by Claude Code