Merge pull request #292 from github/regexp_slash_az

Don't parse `\A` and `\Z` as `RegExpConstant`

ql/test/library-tests/regexp/parse.expected

@@ -146,10 +146,10 @@ regexp.rb:
 
 #   19| [RegExpConstant, RegExpNormalChar] _
 
-#   20| [RegExpConstant, RegExpEscape] \A
+#   20| [RegExpCaret] \A
 
 #   20| [RegExpSequence] \A[+-]?\d+
-#-----| 0 -> [RegExpConstant, RegExpEscape] \A
+#-----| 0 -> [RegExpCaret] \A
 #-----| 1 -> [RegExpOpt] [+-]?
 #-----| 2 -> [RegExpPlus] \d+
 

ql/test/query-tests/security/cwe-1333-polynomial-redos/PolynomialReDoS.rb

@@ -33,7 +33,10 @@ class FooController < ActionController::Base
 
     # GOOD - guarded by a string length check
     if name.length < 1024
-	name.gsub regex, ''
+      name.gsub regex, ''
     end
+
+    # GOOD - regex does not suffer from polynomial backtracking (regression test)
+    params[:foo] =~ /\A[bc].*\Z/
   end
-end
+end