[cd-bitwarden]

🎟️ Tracking

https://bitwarden.atlassian.net/browse/SM-2126

📔 Objective

This PR replaces the regex-based CoreHelpers.SanitizeForEmail with a single-pass linear scan, which removes the quadratic re-scan loop on repeated :// input. It also caps RequestSMAccessRequestModel.EmailContent at 1000 characters and sets a process-wide 5-second Regex default match timeout in each service host's Main.

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

This PR replaces the regex loop in CoreHelpers.SanitizeForEmail with a single-pass scanner, limits RequestSMAccessRequestModel.EmailContent to 1000 characters, and sets a 5-second default Regex match timeout at the start of each service host's Main. I checked the scanner against the old regex for @ replacement, non-overlapping .\w replacement, removal of word-run schemes, a :// at the start of the input, and schemes that only appear after an earlier one is stripped. It also matches on the order of [dot]/[at] insertion versus scheme stripping. The outputs matched, and the backward walk is amortized linear because every character it visits gets truncated. The only open item is the existing question about the Sso and Scim hosts, which has no answer yet.

Code Review Details

• ❓ : Sso and Scim reference Core, but their Main does not call RegexDefaults.ConfigureDefaultMatchTimeout(), though the description says every service host does (open in an existing thread)
  • src/Core/Utilities/RegexDefaults.cs:23

[codecov]

Codecov Report

❌ Patch coverage is 92.98246% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 68.49%. Comparing base (df91576) to head (6dadf97).

Files with missing lines	Patch %	Lines
src/Api/Program.cs	0.00%	1 Missing ⚠️
src/Billing/Program.cs	0.00%	1 Missing ⚠️
src/EventsProcessor/Program.cs	0.00%	1 Missing ⚠️
src/Identity/Program.cs	0.00%	1 Missing ⚠️

❗ There is a different number of reports uploaded between BASE (df91576) and HEAD (6dadf97). Click for more details.

HEAD has 1 upload less than BASE

Flag	BASE (df91576)	HEAD (6dadf97)
	2	1

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8809      +/-   ##
==========================================
- Coverage   74.83%   68.49%   -6.35%     
==========================================
  Files        2750     2751       +1     
  Lines      117618   117664      +46     
  Branches    10781    10791      +10     
==========================================
- Hits        88022    80596    -7426     
- Misses      26940    34528    +7588     
+ Partials     2656     2540     -116     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[claude]

❓ QUESTION: Were the Sso and Scim hosts left out on purpose? Both reference Core, but neither Main calls ConfigureDefaultMatchTimeout().

Details and fix

The PR description says the timeout is set "in each service host's Main". That is true for the eight hosts under src/, but bitwarden_license/src/Sso/Program.cs and bitwarden_license/src/Scim/Program.cs are unchanged. Both reference Core.csproj, and both already have using Bit.Core.Utilities;. So those two processes still run every Regex with no timeout, and SSO handles external IdP input.

If the omission is not intentional, add this as the first statement of each Main:

RegexDefaults.ConfigureDefaultMatchTimeout();

_code-review