fix(library): avoid components key validation timeouts under load

Co-authored-by: baywet <7905502+baywet@users.noreply.github.com>

Author: Copilot

src/Microsoft.OpenApi/Validations/Rules/OpenApiComponentsRules.cs

@@ -1,7 +1,6 @@
 // Copyright (c) Microsoft Corporation. All rights reserved.
 // Licensed under the MIT license.
 
-using System;
 using System.Collections.Generic;
 using System.Text.RegularExpressions;
 
@@ -11,12 +10,17 @@ namespace Microsoft.OpenApi
     /// The validation rules for <see cref="OpenApiComponents"/>.
     /// </summary>
     [OpenApiRule]
-    public static class OpenApiComponentsRules
+    public static partial class OpenApiComponentsRules
     {
         /// <summary>
-        /// The key regex.
+        /// The key regex pattern.
         /// </summary>
-        internal static readonly Regex KeyRegex = new(@"^[a-zA-Z0-9\.\-_]+$", RegexOptions.None, TimeSpan.FromMilliseconds(100));
+        internal const string KeyPattern = @"^[a-zA-Z0-9\.\-_]+$";
+
+#if NET8_0_OR_GREATER
+        [GeneratedRegex(KeyPattern, RegexOptions.None, matchTimeoutMilliseconds: 100)]
+        private static partial Regex KeyRegex();
+#endif
 
         /// <summary>
         /// All the fixed fields declared above are objects
@@ -54,12 +58,47 @@ private static void ValidateKeys(IValidationContext context, IEnumerable<string>
 
             foreach (var key in keys)
             {
-                if (!KeyRegex.IsMatch(key))
+#if NET8_0_OR_GREATER
+                var isValidKey = KeyRegex().IsMatch(key);
+#else
+                var isValidKey = IsValidKey(key);
+#endif
+                if (!isValidKey)
                 {
                     context.CreateError(nameof(KeyMustBeRegularExpression),
-                        string.Format(SRResource.Validation_ComponentsKeyMustMatchRegularExpr, key, component, KeyRegex.ToString()));
+                        string.Format(SRResource.Validation_ComponentsKeyMustMatchRegularExpr, key, component, KeyPattern));
                 }
             }
         }
+
+        internal static bool IsValidKey(string key)
+        {
+            // Match the fixed character class without wall-clock timeouts on downlevel targets.
+            var length = key.Length;
+            // The regex's $ anchor also accepts a single final newline.
+            if (length > 0 && key[length - 1] == '\n')
+            {
+                length--;
+            }
+
+            if (length == 0)
+            {
+                return false;
+            }
+
+            for (var i = 0; i < length; i++)
+            {
+                var character = key[i];
+                if (!(character >= 'a' && character <= 'z') &&
+                    !(character >= 'A' && character <= 'Z') &&
+                    !(character >= '0' && character <= '9') &&
+                    character != '.' && character != '-' && character != '_')
+                {
+                    return false;
+                }
+            }
+
+            return true;
+        }
     }
 }

test/Microsoft.OpenApi.Tests/Validations/OpenApiComponentsValidationTests.cs

@@ -2,7 +2,11 @@
 // Licensed under the MIT license.
 
 using System.Collections.Generic;
+using System.IO;
 using System.Linq;
+using System.Text;
+using System.Text.Json;
+using System.Threading.Tasks;
 using Xunit;
 
 namespace Microsoft.OpenApi.Validations.Tests
@@ -32,8 +36,67 @@ public void ValidateKeyMustMatchRegularExpressionInComponents()
             Assert.False(result);
             Assert.NotNull(errors);
             var error = Assert.Single(errors);
-            Assert.Equal(string.Format(SRResource.Validation_ComponentsKeyMustMatchRegularExpr, key, "responses", OpenApiComponentsRules.KeyRegex.ToString()),
+            Assert.Equal(string.Format(SRResource.Validation_ComponentsKeyMustMatchRegularExpr, key, "responses", @"^[a-zA-Z0-9\.\-_]+$"),
                 error.Message);
         }
+
+        [Theory]
+        [InlineData("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_", true)]
+        [InlineData("", false)]
+        [InlineData("a b", false)]
+        [InlineData("a/b", false)]
+        [InlineData("é", false)]
+        [InlineData("１２", false)]
+        [InlineData("a\n", true)]
+        [InlineData("\n", false)]
+        [InlineData("a\n\n", false)]
+        [InlineData("a\r\n", false)]
+        [InlineData("a\nb", false)]
+        [InlineData("a\0", false)]
+        public void ValidateComponentKeyPreservesRegexBehavior(string key, bool isValid)
+        {
+            var components = new OpenApiComponents
+            {
+                Schemas = new Dictionary<string, IOpenApiSchema>
+                {
+                    { key, new OpenApiSchema() }
+                }
+            };
+
+            var rules = new ValidationRuleSet();
+            rules.Add(typeof(OpenApiComponents), OpenApiComponentsRules.KeyMustBeRegularExpression);
+            var errors = components.Validate(rules);
+
+            Assert.Equal(isValid, OpenApiComponentsRules.IsValidKey(key));
+            Assert.Equal(isValid, !errors.Any());
+        }
+
+        [Theory]
+        [InlineData(true)]
+        [InlineData(false)]
+        public async Task LoadAsyncValidatesLongComponentKeys(bool isValid)
+        {
+            var key = new string('a', 1_000_000) + (isValid ? string.Empty : "!");
+            Assert.Equal(isValid, OpenApiComponentsRules.IsValidKey(key));
+            var json = """
+                {"openapi":"3.1.0","info":{"title":"Test","version":"1.0"},"paths":{},"components":{"schemas":{
+                """ + JsonSerializer.Serialize(key) + ":{\"type\":\"string\"}}}}";
+            using var stream = new MemoryStream(Encoding.UTF8.GetBytes(json));
+
+            var result = await OpenApiDocument.LoadAsync(stream, cancellationToken: TestContext.Current.CancellationToken);
+
+            Assert.NotNull(result.Document);
+            Assert.NotNull(result.Diagnostic);
+            if (isValid)
+            {
+                Assert.Empty(result.Diagnostic.Errors);
+            }
+            else
+            {
+                var error = Assert.Single(result.Diagnostic.Errors);
+                Assert.Equal(string.Format(SRResource.Validation_ComponentsKeyMustMatchRegularExpr,
+                    key, "schemas", @"^[a-zA-Z0-9\.\-_]+$"), error.Message);
+            }
+        }
     }
 }