Fix exponential memory exhaustion in regex combination generator

Summary

This PR fixes an uncontrolled memory/CPU consumption issue in the regex generation engine used by the origins plugin.

Previously, _gen_combinator() fully materialized the Cartesian product of regex alternation branches into memory using:

list(map(_merge_variants, itertools.product(...)))

A crafted regex with many alternation groups could therefore trigger exponential memory growth (K^N combinations), causing the gixy process to consume excessive RAM or terminate via OOM.

This PR introduces a hard cap on generated combinations and removes redundant recomputation in BranchToken.generate().

Root Cause

The vulnerable flow was:

origins.audit()
  -> Regexp.generate()
      -> InternalSubpatternToken.generate()
          -> _gen_combinator()
              -> itertools.product()
              -> list(...)

Because the Cartesian product iterator was eagerly materialized, patterns like:

(a|b)(c|d)(e|f)... repeated N times

generated exponentially many strings in memory.

Changes

1. Limit Cartesian product expansion

Before

producted = itertools.product(*res)

return list(
    six.moves.map(_merge_variants, producted)
)

After

MAX_COMBINATIONS = 1000

producted = itertools.islice(
    itertools.product(*res),
    MAX_COMBINATIONS
)

return list(
    six.moves.map(_merge_variants, producted)
)

This prevents unbounded expansion from attacker-controlled regex input.

2. Fix redundant branch recomputation

Before

values = child.generate(context)

if isinstance(values, list):
    res.extend(child.generate(context))

After

values = child.generate(context)

if isinstance(values, list):
    res.extend(values)

The previous implementation unnecessarily recomputed child branches, doubling CPU work for some patterns.

Security Impact

This issue could be abused in environments where untrusted users can submit nginx configurations for analysis, including:

• CI/CD pipelines
• shared linting infrastructure
• config auditing services
• multi-user development systems

A single crafted regex could exhaust memory and crash the analysis process.

Classification

• CWE-400 — Uncontrolled Resource Consumption
• CWE-770 — Allocation of Resources Without Limits or Throttling
• CWE-407 — Algorithmic Complexity

Compatibility

The change preserves existing functionality while preventing pathological expansion cases.

Large regex expansions are now safely truncated to a bounded number of generated combinations.

Testing

Verified against crafted regex payloads containing many alternation groups.

Previously:

• excessive RAM growth
• process termination / OOM

After patch:

• bounded memory usage
• stable execution