[PERFORMANCE][SECURITY] Refactored Regex to cached (static readonly, Compiled, source generated, with timeout for security)

src/BlazorWebView/src/SharedSource/StaticContentHotReloadManager.cs

@@ -13,11 +13,11 @@
 
 namespace Microsoft.AspNetCore.Components.WebView
 {
-	internal static class StaticContentHotReloadManager
+	internal static partial class StaticContentHotReloadManager
 	{
 		private delegate void ContentUpdatedHandler(string assemblyName, string relativePath);
 
-		private readonly static Regex ContentUrlRegex = new Regex("^_content/(?<AssemblyName>[^/]+)/(?<RelativePath>.*)");
+		private readonly static Regex ContentUrlRegex = RegexHelper.ContentUrlRegex;
 		private static event ContentUpdatedHandler? OnContentUpdated;
 
 		// If the current platform can't tell us the application entry assembly name, we can use a placeholder name
@@ -105,7 +105,7 @@ private static (string AssemblyName, string RelativePath) GetAssemblyNameAndRela
 		// we can use the existing IJSRuntime. In turn we can get an instance of this
 		// that's always attached to the currently-loaded page (if it's a Blazor page)
 		// by injecting this headless root component.
-		private sealed class StaticContentChangeNotifier : IComponent, IDisposable
+		private sealed partial class StaticContentChangeNotifier : IComponent, IDisposable
 		{
 			private ILogger _logger = default!;
 
@@ -154,6 +154,26 @@ private async Task NotifyContentUpdatedAsync(string assemblyName, string relativ
 
 			public Task SetParametersAsync(ParameterView parameters)
 				=> Task.CompletedTask;
+
+		}
+
+		internal static partial class RegexHelper
+		{
+			static readonly ReadOnlySpan<char> pattern = "^_content/(?<AssemblyName>[^/]+)/(?<RelativePath>.*)";
+
+#if NET7_0_OR_GREATER
+			[GeneratedRegex (pattern, RegexOptions.None, matchTimeoutMilliseconds: 1000)]
+			static partial Regex ContentUrlRegex
+			{
+				get;
+			}
+#else
+			static readonly Regex ContentUrlRegex =
+											new (
+												pattern,
+												RegexOptions.Compiled,		
+												TimeSpan.FromMilliseconds(1000)							// against malicious input
+												);
 		}
 	}
 }

src/Compatibility/ControlGallery/src/Core/GalleryPages/GalleryBuilder.cs

@@ -0,0 +1,35 @@
+using System;
+using Microsoft.Maui.Devices;
+
+namespace Microsoft.Maui.Controls.ControlGallery.GalleryPages
+{
+	public static class GalleryBuilder
+	{
+		public static Button NavButton(string galleryName, Func<Page> gallery, INavigation nav)
+		{
+			var automationId = RegexHelper.AutomationIdRegex.Replace(galleryName, string.Empty);
+			var button = new Button { Text = $"{galleryName}", AutomationId = automationId, FontSize = 10, HeightRequest = DeviceInfo.Platform == DevicePlatform.Android ? 40 : 30 };
+			button.Clicked += (sender, args) => { nav.PushAsync(gallery()); };
+			return button;
+		}
+	}
+
+	internal static partial class RegexHelper
+	{
+		static readonly string AutomationIdRegexPattern = " |\\(|\\)";
+		#if NET7_0_OR_GREATER
+		[GeneratedRegex (AutomationIdRegexPattern, RegexOptions.None, matchTimeoutMilliseconds: 1000)]
+		internal static partial Regex AutomationIdRegex
+		{
+			get;
+		}
+		#else
+		internal static readonly Regex AutomationIdRegex =
+										new (
+											AutomationIdRegexPattern,
+											RegexOptions.Compiled,		
+											TimeSpan.FromMilliseconds(1000)							// against malicious input
+											);
+		#endif
+	}
+}