Merge pull request #248 from Microsoft/dm/regexfix

Fix for regex to potentially prevent catastrophic backtracking

Author: darrelmiller

src/Microsoft.OpenApi/Validations/Rules/OpenApiResponsesRules.cs

@@ -28,7 +28,7 @@ public static class OpenApiResponsesRules
                 });
 
         /// <summary>
-        /// The response key must either be "default" or an HTTP status code (1xx, 2xx, 3xx, 4xx, 5xx)
+        /// The response key must either be "default" or an HTTP status code (1xx, 2xx, 3xx, 4xx, 5xx).
         /// </summary>
         public static ValidationRule<OpenApiResponses> ResponsesMustBeIdentifiedByDefaultOrStatusCode =>
             new ValidationRule<OpenApiResponses>(
@@ -38,7 +38,7 @@ public static class OpenApiResponsesRules
                     {
                         context.Enter(key);
 
-                        if (key != "default" && !Regex.IsMatch(key, "^[1-5]([0-9][0-9]|XX)$"))
+                        if (key != "default" && !Regex.IsMatch(key, "^[1-5](?>[0-9]{2}|XX)$"))
                         {
                             context.CreateError(nameof(ResponsesMustBeIdentifiedByDefaultOrStatusCode), 
                                     "Responses key must be 'default', an HTTP status code, " +
@@ -50,4 +50,4 @@ public static class OpenApiResponsesRules
                     }
                 });
     }
-}
+}