Fix quadratic backtracking regex in NER format autodetection

[Fazel94]

Fix quardratic backtracking regex in NER format autodetection

Description

In spacy/cli/convert.py:213-214 r"\S+\|(O|[IB]-\S+)" and r"\S+\s+(O|[IB]-\S+)$" can lead to quadratic backtracking on crafted input.

import re
import time

line = "x|" * 10000

for name, pattern in [
    ("old", r"\S+\|(O|[IB]-\S+)"),
    ("new", r"\S\|(O|[IB]-\S+)"),
]:
    start = time.perf_counter()
    re.search(pattern, line)
    print(f"{name}: {time.perf_counter() - start:.3f}s")

Output:

old: 3.523s
new: 0.001s

For the other regex

import re
import time

line = "a" * 20000

for name, pattern in [
   ("old", r"\S+\s+(O|[IB]-\S+)$"),
   ("new", r"\S\s+(O|[IB]-\S+)$"),
]:
   start = time.perf_counter()
   re.search(pattern, line)
   print(f"{name}: {time.perf_counter() - start:.3f}s")

Output:

old: 4.900s
new: 0.001s

Reasoning:

First regex faces the issue if there is pipes but no ensuing NER tag thus it tests every position in backtracking fashion, and the 20 line cap wouldn't help because it doesn't limit line length.

Second regex if the string contains no whitespace at all it backtracks on every position.

Checklist

• I confirm that I have the right to submit this contribution under the project's MIT license.
• I ran the tests, and all new and existing tests passed.
• My changes don't require a change to the documentation, or if they do, I've added all required information.