Vulnerable code sample

import re

# This code simulates the vulnerable part of Giskard's RegexMatching check.
# The 'run_check' function directly passes a user-supplied pattern and input
# to re.search() without any timeout or complexity guard, creating a
# Regular Expression Denial of Service (ReDoS) vulnerability.

def run_check(pattern, text_input):
    """Simulates the vulnerable check execution."""
    # The vulnerable call: a user-controlled pattern is used directly.
    re.search(pattern, text_input)
    # In a real application, the result would be processed. Here, the
    # process hangs before the function can even return.

# 1. An attacker crafts a malicious regex pattern designed to cause
# "catastrophic backtracking". The nested quantifiers (a+)+ create an
# exponential number of paths for the regex engine to try.
malicious_pattern = r"^(a+)+b$"

# 2. The attacker provides an input string that triggers the worst-case
# performance. This "almost-matching" string forces the engine to explore
# all futile backtracking paths, causing it to hang.
input_to_cause_dos = "a" * 28 + "!"

# 3. The vulnerable check is executed. This call will cause the Python
# process to hang indefinitely, consuming 100% of a CPU core.
run_check(malicious_pattern, input_to_cause_dos)

# The script will never proceed past the line above.