regex 1.13.1: Extract named capture groups with the regex crate, which has no backtracking

# This file is automatically @generated by Cargo.
# It is not intended for manual editing.
version = 4

[[package]]
name = "aho-corasick"
version = "1.1.5"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c982642fa9e8606056828ee9a8505737230110bb1099153c79efe865c59d12ba"
dependencies = [
 "memchr",
]

[[package]]
name = "csx-sample-regex"
version = "1.0.0"
dependencies = [
 "regex",
]

[[package]]
name = "memchr"
version = "2.8.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"

[[package]]
name = "regex"
version = "1.13.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f020237b6c8eed93db2e2cb53c00c60a8e1bc73da7d073199a1180401450218d"
dependencies = [
 "aho-corasick",
 "memchr",
 "regex-automata",
 "regex-syntax",
]

[[package]]
name = "regex-automata"
version = "0.4.18"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ad8553b9b26413251cbf30e620595c7a41b3887f03da04579c0e6b0d6a06b4b2"
dependencies = [
 "aho-corasick",
 "memchr",
 "regex-syntax",
]

[[package]]
name = "regex-syntax"
version = "0.8.11"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"

[package]
name = "csx-sample-regex"
version = "1.0.0"
edition = "2021"
license = "MIT-0"

[dependencies]
regex = "1.13.1"

{"case":{"caseId":"case:sha256:60cda02700b4c544bcc5cf94d290e182bb0cca8b6285ceced916b43ad3418ee0","constraints":{"runtime":"rust"},"contract":["compile a pattern with named groups and extract them","assert a greedy name group splits on the LAST @, so scoped names parse","assert a non-matching input yields None rather than an error","assert backreferences and lookaround are rejected at compile time"],"goal":"Extract named capture groups with the regex crate, which has no backtracking","kind":"HOW","packages":["pkg:cargo/regex@1.13.1"],"schemaVersion":1,"symbols":["Regex::new","captures","name"]},"contractCommand":["cargo","run","--offline","--quiet"],"environment":{"arch":"x64","ecosystem":"cargo","executionContext":"rust","language":"rust","os":"linux","packageManager":"cargo","runtime":"rust","runtimeVersion":"1","schemaVersion":1},"license":"MIT-0","packages":["pkg:cargo/regex@1.13.1"],"schemaVersion":1,"symbols":["Regex::new","captures","name"],"verifierAdapter":"cargo@1"}

use regex::Regex;

/// The regex crate guarantees linear time, and pays for it by refusing
/// backreferences and lookaround entirely — patterns copied from PCRE,
/// Python or JavaScript fail at COMPILE time with an error, they do not
/// silently misbehave. That trade is why untrusted patterns are safe here:
/// there is no catastrophic backtracking to trigger.
fn parse_purl(input: &str) -> Option<(String, String, String)> {
    // Greedy `.+` for the name and a version that cannot contain `@`: the
    // version separator is the LAST `@`, not the first. A lazy name or a
    // `[^@]+` name silently fails on scoped npm packages, whose names begin
    // with `@` — and fails by not matching at all, so the bug shows up as a
    // None rather than as a wrong split.
    let re = Regex::new(r"^pkg:(?<eco>[a-z]+)/(?<name>.+)@(?<version>[^@]+)$").unwrap();
    let caps = re.captures(input)?;
    Some((
        caps.name("eco")?.as_str().to_string(),
        caps.name("name")?.as_str().to_string(),
        caps.name("version")?.as_str().to_string(),
    ))
}

fn main() {
    let (eco, name, version) = parse_purl("pkg:npm/axios@1.19.0").expect("parses");
    assert_eq!(eco, "npm");
    assert_eq!(name, "axios");
    assert_eq!(version, "1.19.0");

    // Scoped npm names contain a slash and still parse.
    let (_, name, _) = parse_purl("pkg:npm/@scope/pkg@2.0.0").expect("scoped parses");
    assert_eq!(name, "@scope/pkg");

    // A non-match is None, not an error and not a panic.
    assert!(parse_purl("not-a-purl").is_none());

    // Backreferences and lookaround are refused at compile time.
    assert!(Regex::new(r"(a)\1").is_err(), "backreference must not compile");
    assert!(Regex::new(r"foo(?=bar)").is_err(), "lookahead must not compile");

    // find_iter walks every match.
    let words = Regex::new(r"[a-z]+").unwrap();
    let found: Vec<&str> = words.find_iter("one two three").map(|m| m.as_str()).collect();
    assert_eq!(found, vec!["one", "two", "three"]);

    println!("CONTRACT PASS: regex captured named groups and rejected backtracking syntax");
}