Possible missing case

[TrueWill]

The first example from https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS is considered safe by isSafePattern: (a+)+

[tjenkinson]

Hey @TrueWill thanks for flagging. That should be unsafe.

Unfortunately this tool currently misses some cases when there's no start anchor.

If you prepend ^.* you'll see the failure.

I've been working on a fix and hopefully will have it ready soon

[tjenkinson]

This will be classed as safe again in https://github.com/tjenkinson/redos-detector/pull/637

(a+)+$ wouldn't be though.

See https://github.com/tjenkinson/redos-detector/issues/624#issuecomment-2452960154 for why