From 1a55a389fca45fbbd302974c39bcd107b058955f Mon Sep 17 00:00:00 2001
From: alex <53851759+alxxjohn@users.noreply.github.com>
Date: Wed, 19 Aug 2026 14:07:51 -0400
Subject: [PATCH] fix(security): avoid retaining dynamic regexes

---
 .../checks/security/security_regex_cache.go   | 26 +++++--------------
 1 file changed, 6 insertions(+), 20 deletions(-)

diff --git a/internal/codeguard/checks/security/security_regex_cache.go b/internal/codeguard/checks/security/security_regex_cache.go
index 587c0ab..137548f 100644
--- a/internal/codeguard/checks/security/security_regex_cache.go
+++ b/internal/codeguard/checks/security/security_regex_cache.go
@@ -1,25 +1,11 @@
 package security
 
-import (
-	"regexp"
-	"sync"
-)
+import "regexp"
 
-// dynamicPatternCache memoizes regexes compiled from runtime-derived text such
-// as import aliases, namespaces, and module names. The same handful of aliases
-// and modules recur across many files in a project, so compiling each distinct
-// pattern once and reusing it avoids recompiling identical regexes per file.
-var dynamicPatternCache sync.Map // map[string]*regexp.Regexp
-
-// compileDynamicPattern returns the compiled form of expr, reusing a previously
-// compiled instance when one exists. The expressions passed here are always
-// valid (fixed fragments plus regexp.QuoteMeta-escaped input), so it mirrors the
-// regexp.MustCompile contract and panics on a genuinely malformed pattern.
+// compileDynamicPattern compiles expressions built from runtime-derived text.
+// Do not cache these expressions globally: aliases and module names originate
+// in scanned source, so an unbounded process-wide cache would retain
+// attacker-controlled entries across scans in long-lived processes.
 func compileDynamicPattern(expr string) *regexp.Regexp {
-	if cached, ok := dynamicPatternCache.Load(expr); ok {
-		return cached.(*regexp.Regexp)
-	}
-	compiled := regexp.MustCompile(expr)
-	actual, _ := dynamicPatternCache.LoadOrStore(expr, compiled)
-	return actual.(*regexp.Regexp)
+	return regexp.MustCompile(expr)
 }