[GreenGrassBlueOcean]

What is the problem

GitHub Advanced Security / CodeQL posted Review #5847970625 (Code Scanning Alert #8, rule py/redos / CWE-1333) on custom_components/myhome/gateway_sessions.py:529 (introduced in #887 for Issue #886):

_WHO4_QUERY_RE = re.compile(r"^\*#4\*(?P<where>[^#*]+(?:#[^*]+)*)(?:\*(?P<dim>\d+))?##$")

In (?P<where>[^#*]+(?:#[^*]+)*), the repeated inner group (?:#[^*]+)* uses [^*]+, which matches # as well as non-# characters. On malformed strings starting with *#4*<zone># followed by repeated #... segments without a trailing ##, the regex engine can partition the #-delimited segments between a single [^*]+ run and multiple (?:#[^*]+) repetitions in $2^{k-1}$ ways, causing exponential backtracking.

---

What is the solution

1. Make #-separated segments disjoint in _WHO4_QUERY_RE (custom_components/myhome/gateway_sessions.py):
   • Change (?:#[^*]+)* to (?:#[^#*]+)*:

     _WHO4_QUERY_RE = re.compile(r"^\*#4\*(?P<where>[^#*]+(?:#[^#*]+)*)(?:\*(?P<dim>\d+))?##$")

   • Because [^#*]+ cannot consume # or *, every # inside <where> deterministically starts a new (?:#[^#*]+) segment and can never consume the trailing ## terminator, eliminating all backtracking ambiguity while matching the exact same set of valid OpenWebNet WHO=4 WHERE tokens (1..99, Z#N, Z#4#II).
2. Add regression assertions (tests/test_issue_886_myhomeserver1_41_zones.py):
   • Verify that _mismatched_who4_reply_zones matches multi-segment WHERE queries (*#4*60#4#01*60##) and rejects pathological multi-# strings ("*#4*1" + "#a" * 40 + "!") in linear time.

---

State Diagram

N/A (deterministic regex character-class tightening; no state machine changes)

---

Hardware Verification

N/A (verified against the existing 41-zone MyHomeServer1 3.87.13 trace suite in tests/test_issue_886_myhomeserver1_41_zones.py)

---

How is it tested

• tests/test_issue_886_myhomeserver1_41_zones.py, tests/test_gateway_sessions.py: 88 passed in 7.82s
• ruff check custom_components tests scripts: All checks passed!
• python scripts/verify_ha_standards.py: SUCCESS: All Home Assistant architectural standards passed!
• python scripts/sync_documentation.py --check: SUCCESS: All documentation is calibrated and in sync with the codebase!

---

Where are the traces

• tests/fixtures/traces/issue_886/myhome_trace_MyHomeServer1_41_zones_2026-11-09.json (2,428 frames)

---

What does the Firmware Oracle / Encyclopedia say

Queried via openwebnet-mcp (lookup_frame_syntax(who=4, frame_type="STATUS_REQUEST")):

• OpenWebNet STATUS_REQUEST / DIMENSION_REQUEST WHERE parameters are #-separated non-empty tokens ((?P<where>#?\d+)(?P<where_param>(?:#\d+)*)), and ## is reserved exclusively as the frame delimiter. Excluding # inside each segment ((?:#[^#*]+)*) is 100% aligned with the OpenWebNet frame grammar.

---

Checklist

• PR Description: Follows the structured sections above (What is the problem, What is the solution, State Diagram, How is it tested, Where are the traces, What does the Firmware Oracle / Encyclopedia say).
• Trace-Backed (if protocol/device change): Behavior is verified against real OpenWebNet bus traces or gateway firmware fixtures rather than guessed.
• V2 Architecture: New or modified entities implement handle_event() and do not manually subscribe via async_dispatcher_connect.
• Tests & Linters: pytest, ruff, and scripts/verify_ha_standards.py pass.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!