[linter-miner] Add regexpdynamicpattern linter: flag non-constant regexp patterns #50662

New linter: regexpdynamicpattern

Adds a custom go/analysis linter that flags regexp.Compile and regexp.MustCompile calls whose pattern argument is not a compile-time constant string (e.g. built via fmt.Sprintf, string concatenation with a variable, or passed straight through from a function parameter).

Why this matters

• Panics: regexp.MustCompile panics if the pattern is malformed. When the pattern is dynamically constructed, this can happen at runtime on unexpected input rather than at startup.
• ReDoS: if the dynamic portion of the pattern is influenced by untrusted/user-controlled input, it can enable catastrophic-backtracking (ReDoS) denial-of-service attacks.
• Complements existing tooling: the repo already has regexpcompileinfunction, which only flags compilation happening inside a function body (regardless of whether the pattern is constant). This new linter targets a different, security-relevant dimension — constant vs. dynamic pattern — and applies at both package level and inside functions.

Evidence

Research mining recent Discussions/Issues/CHANGELOG history in github/gh-aw surfaced a recurring theme of injection-style vulnerabilities from unescaped/dynamically-built strings feeding into generated shell/YAML/regex contexts (e.g. past CodeQL alerts on unsafe quoting). A direct code scan of pkg/ and cmd/ confirmed several regexp.Compile/MustCompile call sites exist where the pattern is not always a literal, motivating a dedicated static check to catch this pattern going forward.

Implementation

• New package: pkg/linters/regexpdynamicpattern/regexpdynamicpattern.go (mirrors the structure/conventions of pkg/linters/largefunc and pkg/linters/regexpcompileinfunction)
• Test: regexpdynamicpattern_test.go using analysistest, with fixtures under testdata/src/regexpdynamicpattern/ covering: literal patterns (not flagged), const patterns (not flagged), fmt.Sprintf-built patterns (flagged), string-concatenation with a variable (flagged), pattern passed through from a parameter (flagged), constant-only concatenation (not flagged), and //nolint:regexpdynamicpattern suppression (both same-line and previous-line).
• Registered in pkg/linters/registry.go (All()), documented in pkg/linters/doc.go and pkg/linters/README.md, and added to pkg/linters/spec_test.go's documentedAnalyzers() list to keep the doc-sync tests passing.

Validation

• go test ./pkg/linters/... — all packages pass, including the doc-sync tests (TestDocGo_CountMatchesBullets, TestDocSurfacesMatchRegistryAndSpecList, TestRegistryMatchesDocumentation).
• go build ./cmd/linters/... succeeds and the new -regexpdynamicpattern flag is exposed by the multichecker binary.
• gofmt -l shows no issues in the newly added files.

# Download the patch from the workflow run
gh run download 31032190890 -n agent -D /tmp/agent-31032190890

# Create a new branch
git checkout -b linter-miner/regexpdynamicpattern-28ae4ac216c8dae1 main

# Apply the patch (--3way handles cross-repo patches)
git am --3way /tmp/agent-31032190890/aw-linter-miner-regexpdynamicpattern.patch

# Push the branch and create the pull request
git push origin linter-miner/regexpdynamicpattern-28ae4ac216c8dae1
gh pr create --title '[linter-miner] Add regexpdynamicpattern linter: flag non-constant regexp patterns' --base main --head linter-miner/regexpdynamicpattern-28ae4ac216c8dae1 --repo github/gh-aw

Generated by Linter Miner · auto · 118.8 AIC · ⌖ 14.8 AIC · ⊞ 7.7K · ◷

• expires on Aug 12, 2026, 10:13 AM UTC-08:00