Clarify regex warnings

[GrabYourPitchforks]

Doc changes only. No code changes.

I'm updating regex docs across the various docs repos. This is one part of that update.

Changes:

• Put a DoS warning on the type itself with forward links to relevant info.
• (Still trying to figure out where to remove the vestigial ctor-level warnings.)
• Update external link from CISA to OWASP. The CISA guidance is primarily DDoS-related, which isn't quite relevant to the discussion here. OWASP's discussion is geared specifically toward ReDoS, which is on point.

Related PRs:

• Fix incorrect usage of regex in WPF sample docs-desktop#2250
• Reword some regex safety warnings docs#54621
• Reword some regex safety warnings dotnet-api-docs#12848
• Clarify regex warnings #130271 (this one)

[GrabYourPitchforks]

@gewarren Here's the other PR you suggested I open.

[Copilot]

Pull request overview

Updates in-source XML documentation for System.Text.RegularExpressions to better surface security guidance and to improve links to Learn content.

Changes:

• Update RegexOptions.NonBacktracking documentation to reference the relevant “NonBacktracking mode” section in the Learn article.
• Replace Regex type remarks with markdown-formatted remarks that include a prominent ReDoS/DoS warning and links to best practices.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
src/libraries/System.Text.RegularExpressions/src/System/Text/RegularExpressions/RegexOptions.cs	Tweaks the doc comment for NonBacktracking to point readers at the relevant Learn section.
src/libraries/System.Text.RegularExpressions/src/System/Text/RegularExpressions/Regex.cs	Updates type-level remarks to markdown and adds a security warning plus forward links.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

[jeffhandley]

Reasonable suggestion from Copilot here.

[github-actions]

Copilot Code Review

Holistic Assessment

Motivation: Well-justified. Adding a prominent ReDoS security warning at the Regex type level is valuable — it surfaces the risk before developers reach individual APIs. The OWASP link is more appropriate than the prior CISA reference since it targets ReDoS specifically.

Approach: Correct. Uses the established <format type="text/markdown"><![CDATA[...]]> pattern already present in sibling Regex.Match.cs, and the > [!WARNING] admonition is standard for learn.microsoft.com docs rendering.

Summary: ✅ LGTM. This is a well-scoped, documentation-only change that improves security guidance without risk. The format matches existing patterns in the same file area, and the content is accurate.

---

Detailed Findings

Detailed Findings

✅ Documentation Format — Matches existing codebase patterns

The CDATA markdown approach (<remarks><format type="text/markdown"><![CDATA[...]]></format></remarks>) is consistent with Regex.Match.cs line 445+. The <xref:...> syntax and > [!WARNING] admonition block are standard for the docs rendering pipeline.

✅ RegexOptions.cs — Correct section title reference

The text now reads "NonBacktracking mode" section in the which accurately identifies the section heading in the linked Regular Expression Options article. This was fixed in the follow-up typo commit.

💡 URL consistency — Minor observation

The new warning links to (learn.microsoft.com/redacted) while the existing (related)element at the bottom links to.../best-practices`. These appear to be different slugs; given this is part of a coordinated multi-repo docs update (per the PR description), this is presumably intentional.

💡 Line wrapping — Already flagged by existing reviewer

The long single-line paragraph and warning in the new (remarks) block differs from the wrapped style used in Regex.Match.cs. An existing review thread already covers this observation.

Note

This review was generated by GitHub Copilot.

Generated by Code Review for issue #130271 · ● 14M · ◷