fix(adoption-analyzer): remove polynomial ReDoS in nx-projects path regex (#4965)

* fix(adoption-analyzer): remove polynomial ReDoS in nx-projects path regex

Replace the trailing-slash regex /\/+$/ with a linear-time helper. The
regex ran on project.root (parsed from project.json/package.json, treated
as untrusted library input) and had O(n^2) backtracking on inputs with
many trailing '/' not ending in '/', flagged by CodeQL js/polynomial-redos
(alert #120, high). Behaviour is unchanged; adds a targeted test.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* test(adoption-analyzer): cover root "." → empty prefix branch

Adds the test case suggested in review to fully cover the
buildProjectIndex conditional (root "." maps to an empty prefix
that resolves every path).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: wpe1arhy

libs/backpack-adoption-analyzer/src/analysis/nx-projects-test.ts

@@ -102,6 +102,26 @@ describe("nx-projects", () => {
     });
   });
 
+  describe("buildProjectIndex", () => {
+    it("strips trailing slashes from the project root when building the prefix", () => {
+      const [entry] = buildProjectIndex([
+        { name: "web", root: "apps/web///", type: null },
+      ]);
+
+      expect(entry.prefix).toBe("apps/web/");
+      expect(resolveProject("apps/web/Home.tsx", [entry])).toBe("web");
+    });
+
+    it("maps a root of \".\" to an empty prefix that matches every path", () => {
+      const [entry] = buildProjectIndex([
+        { name: "root", root: ".", type: null },
+      ]);
+
+      expect(entry.prefix).toBe("");
+      expect(resolveProject("App.tsx", [entry])).toBe("root");
+    });
+  });
+
   describe("resolveProject", () => {
     it("uses longest-prefix match and falls back to the unassigned bucket", () => {
       const index = buildProjectIndex([

libs/backpack-adoption-analyzer/src/analysis/nx-projects.ts

@@ -88,12 +88,18 @@ export function detectNxProjects(
   return { isNx: true, projects };
 }
 
+function stripTrailingSlashes(value: string): string {
+  let end = value.length;
+  while (end > 0 && value[end - 1] === "/") end -= 1;
+  return value.slice(0, end);
+}
+
 export function buildProjectIndex(projects: NxProject[]): NxProjectIndexEntry[] {
   return projects
     .map((project) => ({
       name: project.name,
       root: project.root,
-      prefix: project.root === "." ? "" : `${project.root.replace(/\/+$/, "")}/`,
+      prefix: project.root === "." ? "" : `${stripTrailingSlashes(project.root)}/`,
     }))
     .sort((a, b) => b.prefix.length - a.prefix.length);
 }