Fix slow pattern and regex

[p4p3r]

No description provided.

[linear]

RULES-5745 Fix evil (very very slow) rule included in auto config

This cors regex rule –
https://semgrep.dev/r?q=typescript.lang.security.audit.cors-regex-wildcard.cors-regex-wildcard

can take > 10s to run for a single naughty file.

See PA-3147 for more context.

lewis said in PA-3147:

Whoever does fix it should just do

      - pattern-either:
          - pattern: $CORS = [...,/$PATTERN/,...]
          - pattern: $CORS = /$PATTERN/
      - focus-metavariable: $PATTERN

and then do the desired regex inside the //, otherwise you are matching EVERY assignment and EVERY value inside a list. Plus you shouldn't rely on const just use $CORS
:homerdisappear:

[LewisArdern]

lgtm, the rule is confusing tho a wildcard CORS generally means * in the cors policy, what this means is that the domain can be something else than intended e.g.

https://quxabizabazafoobar.com

will match because of the regex since its not escaping the .

[p4p3r]

Time on https://github.com/returntocorp/advisory-frontend/blob/main/app/api/inngest/popular-packages-2.ts:
0.97s user 0.13s system 94% cpu 1.156s total

Time on https://github.com/returntocorp/advisory-frontend/blob/main/app/api/inngest/popular-packages.ts:
0.76s user 0.13s system 93% cpu 0.950s total