shellpattern: avoid exponential backtracking for runs of * wildcards, see #2624

[ThomasWaldmann]

Addresses the sh: part of #2624 (pattern evaluation is easily DoS'd).

Problem

sh: patterns were translated 1:1 into SRE regexes ([^/]* per *), so a handful of wildcards is enough for exponential matching time: input/a*a*a*a*a*b takes ~2.4 s to not match a name of 200 as, 10 stars never finish (the issue's reproducer). fm: patterns do not have this problem anymore since Python 3.11: fnmatch.translate() emits atomic groups for * fixed pairs (bpo-40480).

Change

shellpattern.translate() now does the same for sh: patterns: a * FIXED * sequence is emitted as (?>[^/]*?FIXED)[^/]* — FIXED is matched at its leftmost occurrence and the regex engine cannot backtrack into it. This is equivalent to the old regex as long as both neighbours are plain * (also when FIXED contains /): if a match exists using a later occurrence of FIXED, one also exists using the leftmost one, because the left * just absorbs less and the right * absorbs the (slash-free) difference. It is not equivalent when the right neighbour is **/ (*a**/b must match aab) or when FIXED is a {,} alternatives group (*{a,ab}c must match abc), so the atomic group is only used between plain stars. Adjacent * and adjacent **/ are collapsed, they are equivalent to a single one.

* FIXED at the end of a pattern is left as is (linear anyway), **/ chains stay polynomial and {a*,a*}-style chains stay exponential — those and re: patterns are still covered by the warning in borg help patterns, which is updated accordingly.

Numbers

• input/ + a* × 50 + b vs. 200 as: never finished → 0 ms (new test test_no_exponential_backtracking).
• 60 000 random patterns (ab/*?{,}[]!\) × random paths: identical results with old and new translate().
• Existing shellpattern/patterns/archiver pattern tests unchanged and passing.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.05%. Comparing base (0c34d24) to head (10fe875).
⚠️ Report is 5 commits behind head on master.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #10174      +/-   ##
==========================================
- Coverage   87.05%   87.05%   -0.01%     
==========================================
  Files         101      101              
  Lines       18147    18170      +23     
  Branches     2782     2788       +6     
==========================================
+ Hits        15797    15817      +20     
- Misses       1642     1645       +3     
  Partials      708      708              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.