Sieve :regex patterns were compiled with the regex library's default
10 MiB size limit, so every :regex key in a user's script could hold
that much memory for as long as the script was cached. A pattern built
from variables ("${x}") was compiled again for every header or value it
was tested against: a user's script tested against a message with many
headers spent seconds of CPU on each delivery, and anyone could send
that message.
Patterns now compile to at most 1 MiB (the matcher and its lazy DFA
each); a script with a larger one fails to compile with "Invalid regular
expression". Patterns built from variables are compiled once per script
run (up to 32 kept), and a pattern that fails to compile no longer trips
a debug assertion.
Test: on main a script with ^\w{200}$ compiled, and a variable pattern
tested against 1,000 headers took 16.7 s against 18 ms for one header;
the script is now refused and 1,000 headers take as long as one.
jcoffey-dev
70bac69c2e