Merge pull request #6507 from tausbn/python-prevent-polynomial-redos-explosion

Python: Prevent explosion in poly-ReDoS query

python/ql/src/semmle/python/security/performance/RegExpTreeView.qll

@@ -12,4 +12,8 @@ import semmle.python.RegexTreeView
  */
 predicate isExcluded(RegExpParent parent) {
   not exists(parent.getRegex().getLocation().getFile().getRelativePath())
+  or
+  // Regexes with many occurrences of ".*" may cause the polynomial ReDoS computation to explode, so
+  // we explicitly exclude these.
+  count(int i | exists(parent.getRegex().getText().regexpFind("\\.\\*", i, _)) | i) > 10
 }