Fix polynomial ReDoS in regexify alternation matching

[augustocbx]

Motivation / Background

This Pull Request fixes the remaining "Polynomial regular expression used on uncontrolled data" code-scanning alert. Fixes #3183.

In Faker::Base#regexify (lib/faker.rb), the pattern that expands alternation groups such as (this|that) was:

.gsub(/\((.*?)\)/) { |match| sample(match.gsub(/[()]/, '').split('|')) }

\(.*?\) runs in polynomial time on uncontrolled (locale) input: because the .*? content can itself match (, an input like (a(a(a… forces super-linear backtracking. #3196 hardened every sibling regex in this method (possessive quantifiers) but this one was left unchanged, so the alert remained.

Solution

Restrict the captured group content to non-parenthesis characters:

.gsub(/\(([^()]*)\)/) { |match| sample(match.gsub(/[()]/, '').split('|')) }

[^()]* cannot backtrack across a ( or ) delimiter, so matching is linear. This is the standard remedy for this CodeQL pattern and mirrors the backtracking-elimination approach already taken in #3196 for the neighbouring regexes. It is also consistent with regexify's own documented contract — its header comment states it "does not handle … nested parentheses" — so behaviour is unchanged for every supported pattern.

I confirmed the fix with the same CodeQL query GitHub runs (rb/polynomial-redos, bundle 2.25.6): the alert on this regex is present before the change and gone after it, while the unrelated alerts elsewhere are unaffected.

Behaviour is byte-for-byte identical on all supported inputs (alternations, empty (), no-group strings, multiple/quantified groups); only nested parentheses — which regexify explicitly does not support and no locale data uses — match differently.

Additional information

• Determinism preserved: sample / split logic is untouched, output under a fixed seed is unchanged.
• Backward compatibility: no observable change for supported patterns; no public API change.
• A regression case ((foo|bar|baz)) was added to test_regexify to guard the alternation path.
• bundle exec rake is green: 2179 tests, 0 failures, 0 errors; RuboCop clean.

Checklist

• This Pull Request is related to one change only.
• Commit message describes what changed and why, and references the issue ([Fix #3183]).
• Tests are added or updated.
• bundle exec rake (tests + RuboCop) passes locally.
• No new generator/locale/feature; no CHANGELOG edits; determinism preserved.