From 65cd0700e4cbc05372140d4fe33bfc6e2412a161 Mon Sep 17 00:00:00 2001
From: Matt Jankowski <matt@jankowski.online>
Date: Tue, 17 Oct 2023 09:58:42 -0400
Subject: [PATCH] Refactor domains cli to remove model call from regex (#25878)

---
 config/brakeman.ignore      | 24 ------------------------
 lib/mastodon/cli/domains.rb |  6 +++++-
 2 files changed, 5 insertions(+), 25 deletions(-)

diff --git a/config/brakeman.ignore b/config/brakeman.ignore
index 02ce23a07..9f85ccb6a 100644
--- a/config/brakeman.ignore
+++ b/config/brakeman.ignore
@@ -33,30 +33,6 @@
       ],
       "note": ""
     },
-    {
-      "warning_type": "Denial of Service",
-      "warning_code": 76,
-      "fingerprint": "7b6abba5699755348e7ee82a4694bfbf574b41c7cce2d0db0f7c11ae3f983c72",
-      "check_name": "RegexDoS",
-      "message": "Model attribute used in regular expression",
-      "file": "lib/mastodon/cli/domains.rb",
-      "line": 128,
-      "link": "https://brakemanscanner.org/docs/warning_types/denial_of_service/",
-      "code": "/\\.?(#{DomainBlock.where(:severity => 1).pluck(:domain).map do\n Regexp.escape(domain)\n end.join(\"|\")})$/",
-      "render_path": null,
-      "location": {
-        "type": "method",
-        "class": "Mastodon::CLI::Domains",
-        "method": "crawl"
-      },
-      "user_input": "DomainBlock.where(:severity => 1).pluck(:domain)",
-      "confidence": "Weak",
-      "cwe_id": [
-        20,
-        185
-      ],
-      "note": ""
-    },
     {
       "warning_type": "Cross-Site Scripting",
       "warning_code": 4,
diff --git a/lib/mastodon/cli/domains.rb b/lib/mastodon/cli/domains.rb
index d17b25368..329f17167 100644
--- a/lib/mastodon/cli/domains.rb
+++ b/lib/mastodon/cli/domains.rb
@@ -125,7 +125,7 @@ module Mastodon::CLI
       failed          = Concurrent::AtomicFixnum.new(0)
       start_at        = Time.now.to_f
       seed            = start ? [start] : Instance.pluck(:domain)
-      blocked_domains = /\.?(#{DomainBlock.where(severity: 1).pluck(:domain).map { |domain| Regexp.escape(domain) }.join('|')})$/
+      blocked_domains = /\.?(#{Regexp.union(domain_block_suspended_domains).source})$/
       progress        = create_progress_bar
 
       pool = Concurrent::ThreadPoolExecutor.new(min_threads: 0, max_threads: options[:concurrency], idletime: 10, auto_terminate: true, max_queue: 0)
@@ -189,6 +189,10 @@ module Mastodon::CLI
 
     private
 
+    def domain_block_suspended_domains
+      DomainBlock.suspend.pluck(:domain)
+    end
+
     def stats_to_summary(stats, processed, failed, start_at)
       stats.compact!