restrict computation of ConcatenationRoot::getConstantStringParts to results that are less than 1 million chars long

javascript/ql/src/semmle/javascript/StringOps.qll

@@ -574,7 +574,7 @@ module StringOps {
       not exists(getStringValue()) and
       result =
         strictconcat(StringLiteralLike leaf |
-          leaf = getALeaf().asExpr()
+          leaf = this.(SmallConcatenationRoot).getALeaf().asExpr()
         |
           leaf.getStringValue()
           order by
@@ -583,6 +583,17 @@ module StringOps {
     }
   }
 
+  /**
+   * A concatenation root where the combined length of the constant parts
+   * is less than 1 million chars.
+   */
+  private class SmallConcatenationRoot extends ConcatenationRoot {
+    SmallConcatenationRoot() {
+      sum(StringLiteralLike leaf | leaf = getALeaf().asExpr() | leaf.getStringValue().length()) <
+        1000 * 1000
+    }
+  }
+
   /** A string literal or template literal without any substitutions. */
   private class StringLiteralLike extends Expr {
     StringLiteralLike() {