refactor: simplify regex patterns to prevent catastrophic backtracking

- Use bounded quantifiers in regex patterns to prevent ReDoS
- Simplify leader name extraction logic for better maintainability
- Add explicit whitespace and length limits to prevent excessive backtracking
- Improve regex readability with pattern variables

Author: PawanMohit16

backend/apps/owasp/models/common.py

@@ -2,7 +2,6 @@
 
 from __future__ import annotations
 
-import itertools
 import logging
 import re
 from urllib.parse import urlparse
@@ -198,17 +197,28 @@ def get_leaders(self):
 
         leaders = []
         for line in content.split("\n"):
-            leaders.extend(
-                [
-                    name
-                    for name in itertools.chain(
-                        *re.findall(
-                            r"[-*]\s*\[\s*([^(]+?)\s*(?:\([^)]*\))?\]|\*\s*([\w\s]+)", line.strip()
-                        )
-                    )
-                    if name.strip()
-                ]
+            stripped_line = line.strip()
+            names = []
+
+            # Match [name] or [name (optional_info)] patterns
+            # Using bounded quantifiers {0,3} to prevent catastrophic backtracking
+            bracketed_pattern = (
+                r"[-*]\s{0,3}\[\s{0,3}([^\]\(]{1,200})"
+                r"(?:\s{0,3}\([^)]{0,100}\))?\s{0,3}\]"
             )
+            names.extend(re.findall(bracketed_pattern, stripped_line))
+
+            # Match * name patterns
+            names.extend(re.findall(r"\*\s{0,3}([\w\s]{1,200})", stripped_line))
+
+            # Clean names by removing parenthetical info (avoid PLW2901)
+            cleaned_names = []
+            for raw_name in names:
+                if raw_name.strip():
+                    cleaned = re.sub(r"\s*\([^)]{0,100}\)\s*$", "", raw_name).strip()
+                    cleaned_names.append(cleaned)
+
+            leaders.extend(cleaned_names)
 
         return leaders
 
@@ -220,23 +230,31 @@ def get_leaders_emails(self):
 
         leaders = {}
         for line in content.split("\n"):
-            matches = re.findall(
-                r"^[-*]\s*\[([^\]]+)\]\((?:mailto:)?([^)]+)(\)|([^[<\n]))", line.strip()
+            stripped_line = line.strip()
+            # Use bounded quantifiers to prevent backtracking on malformed input
+            # Match [name](email) or [name](mailto:email) patterns
+            email_pattern = (
+                r"^[-*]\s{0,3}\[([^\]]{1,200})\]"
+                r"\((?:mailto:)?([^)]{1,300})\)"
             )
+            matches = re.findall(email_pattern, stripped_line)
 
-            for match in matches:
-                if match[0] and match[1]:  # Name with email
-                    leaders[match[0].strip()] = match[1].strip()
-                elif match[2]:  # Name without email
-                    leaders[match[2].strip()] = None
+            for raw_name, raw_email in matches:
+                name = raw_name.strip()
+                email = raw_email.strip()
+                if name and email:
+                    leaders[name] = email
+                elif name:
+                    leaders[name] = None
 
         return leaders
 
     def get_metadata(self):
         """Get entity metadata."""
         try:
+            metadata_pattern = r"^---\s{0,3}((?:.|\n){0,10000}?)\s{0,3}---"
             yaml_content = re.search(
-                r"^---\s*(.*?)\s*---",
+                metadata_pattern,
                 get_repository_file_content(self.index_md_url),
                 re.DOTALL,
             )
@@ -282,7 +300,8 @@ def get_urls(self, domain=None):
 
         urls = set()
 
-        markdown_links = re.findall(r"\[([^\]]*)\]\((https?://[^\s\)]+)\)", content)
+        markdown_pattern = r"\[([^\]]*)\]\((https?://[^\s\)]+)\)"
+        markdown_links = re.findall(markdown_pattern, content)
         for _text, url in markdown_links:
             cleaned_url = clean_url(url)
             if cleaned_url and validate_url(cleaned_url):
@@ -311,11 +330,10 @@ def parse_tags(self, tags) -> list[str]:
         if not tags:
             return []
 
-        return (
-            [tag.strip(", ") for tag in tags.split("," if "," in tags else " ")]
-            if isinstance(tags, str)
-            else tags
-        )
+        if isinstance(tags, str):
+            separator = "," if "," in tags else " "
+            return [tag.strip(", ") for tag in tags.split(separator)]
+        return tags
 
     def sync_leaders(self, leaders_emails):
         """Sync Leaders data.

frontend/__tests__/unit/pages/CreateModule.test.tsx

@@ -121,5 +121,5 @@ describe('CreateModulePage', () => {
       expect(mockCreateModule).toHaveBeenCalled()
       expect(mockPush).toHaveBeenCalledWith('/my/mentorship/programs/test-program')
     })
-  })
+  }, 10000)
 })