Addresses security and performance issues in trim_start_pattern and trim_end_pattern where regex compilation occurs on every call with unbounded user input.

Changes

• Pattern length validation: 100 char limit to mitigate ReDoS attacks
• Global regex cache: OnceLock<Mutex<HashMap<String, Arc<Regex>>>> to avoid recompiling identical patterns
• Arc wrapping: Share compiled regex state machines without clone overhead
• Documentation: Security notes on remaining ReDoS risks from complex nested patterns

Implementation

// Before: recompiles on every call
match regex::Regex::new(&regex_pattern) {
    Ok(re) => { /* use re */ }
    Err(_) => s.trim_start(),
}

// After: cached and validated
if pattern.len() > MAX_PATTERN_LENGTH {
    return s.trim_start();
}
if let Some(re) = get_cached_regex(&regex_pattern) {
    // Arc::clone is cheap, re is shared
}

Cache is naturally bounded by pattern length limit and typical usage (primarily \s and [\r\n] patterns hit fast paths).

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.