[General] Add ReDoS protection for regex matching and nit fixes.

examples/Demo/Shared/Microsoft.FluentUI.AspNetCore.Components.xml

@@ -5302,9 +5302,6 @@
         <member name="P:Microsoft.FluentUI.AspNetCore.Components.FluentInputFile.Module">
             <summary />
         </member>
-        <member name="P:Microsoft.FluentUI.AspNetCore.Components.FluentInputFile.DropOver">
-            <summary />
-        </member>
         <member name="P:Microsoft.FluentUI.AspNetCore.Components.FluentInputFile.ClassValue">
             <summary />
         </member>
@@ -10308,6 +10305,11 @@
             Gets the default tooltip options.
             </summary>
         </member>
+        <member name="P:Microsoft.FluentUI.AspNetCore.Components.FluentTooltip.AriaLabel">
+            <summary>
+            Gets or sets the text used on aria-label attribute.
+            </summary>
+        </member>
         <member name="P:Microsoft.FluentUI.AspNetCore.Components.FluentTooltip.HideTooltipOnCursorLeave">
             <summary>
             Gets or sets the value indicating whether the library should close the tooltip if the cursor leaves the anchor and the tooltip.
@@ -15901,12 +15903,6 @@
         <member name="T:System.Text.RegularExpressions.Generated.Utilities">
             <summary>Helper methods used by generated <see cref="T:System.Text.RegularExpressions.Regex"/>-derived implementations.</summary>
         </member>
-        <member name="F:System.Text.RegularExpressions.Generated.Utilities.s_defaultTimeout">
-            <summary>Default timeout value set in <see cref="T:System.AppContext"/>, or <see cref="F:System.Text.RegularExpressions.Regex.InfiniteMatchTimeout"/> if none was set.</summary>
-        </member>
-        <member name="F:System.Text.RegularExpressions.Generated.Utilities.s_hasTimeout">
-            <summary>Whether <see cref="F:System.Text.RegularExpressions.Generated.Utilities.s_defaultTimeout"/> is non-infinite.</summary>
-        </member>
         <member name="F:System.Text.RegularExpressions.Generated.Utilities.s_ascii_20FF03FEFFFF87FEFFFF07">
             <summary>Supports searching for characters in or not in "-0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_abcdefghijklmnopqrstuvwxyz".</summary>
         </member>

src/Core/Components/Accordion/FluentAccordion.razor.cs

@@ -53,12 +53,12 @@ private async Task HandleOnAccordionChangedAsync(AccordionChangeEventArgs args)
     {
         if (args is not null)
         {
-            var Id = args.ActiveId;
-            if (Id is not null && items.TryGetValue(Id!, out FluentAccordionItem? item))
+            var id = args.ActiveId;
+            if (id is not null && items.TryGetValue(id!, out FluentAccordionItem? item))
             {
                 item.Expanded = args.Expanded;
                 await OnAccordionItemChange.InvokeAsync(item);
-                await ActiveIdChanged.InvokeAsync(Id);
+                await ActiveIdChanged.InvokeAsync(id);
             }
         }
     }

src/Core/Components/DataGrid/Columns/ColumnBase.razor.cs

@@ -269,7 +269,7 @@ protected void HandleKeyDown(FluentKeyCodeEventArgs e)
     /// <summary>
     /// Constructs an instance of <see cref="ColumnBase{TGridItem}" />.
     /// </summary>
-    public ColumnBase()
+    protected ColumnBase()
     {
         HeaderContent = RenderDefaultHeaderContent;
         HeaderTitleContent = RenderDefaultHeaderTitle;

src/Core/Components/Emojis/Emoji.cs

@@ -17,7 +17,7 @@ public class Emoji : EmojiInfo
     /// Please use the constructor including parameters.
     /// </summary>
     /// <exception cref="ArgumentNullException"></exception>
-    public Emoji() : this(string.Empty, EmojiSize.Size16, EmojiGroup.Flags, EmojiSkintone.Default, EmojiStyle.Flat, new byte[] { })
+    public Emoji() : this(string.Empty, EmojiSize.Size16, EmojiGroup.Flags, EmojiSkintone.Default, EmojiStyle.Flat, Array.Empty<byte>())
     {
         throw new ArgumentNullException("Please use the constructor including parameters.");
     }

src/Core/Components/InputFile/FluentInputFile.razor.cs

@@ -41,9 +41,6 @@ public FluentInputFile()
     /// <summary />
     private IJSObjectReference? Module { get; set; }
 
-    /// <summary />
-    private bool DropOver { get; set; } = false;
-
     /// <summary />
     protected string? ClassValue => new CssBuilder(Class)
         .AddClass("fluent-inputfile-container")

src/Core/Components/List/ListComponentBase.razor.cs

@@ -206,7 +206,7 @@ protected string? InternalValue
     public Expression<Func<IEnumerable<TOption>>>? SelectedOptionsExpression { get; set; }
 
     /// <summary />
-    public ListComponentBase()
+    protected ListComponentBase()
     {
         _internalListContext = new(this);
 

src/Core/Components/Overlay/FluentOverlay.razor.cs

@@ -305,6 +305,6 @@ private async Task InvokeOverlayDisposeAsync()
         }
     }
 
-    [GeneratedRegex("^(?:#(?:[a-fA-F0-9]{6}|[a-fA-F0-9]{3}))")]
+    [GeneratedRegex("^(?:#(?:[a-fA-F0-9]{6}|[a-fA-F0-9]{3}))", RegexOptions.None, matchTimeoutMilliseconds: 1000)] //Add timeout to prevent ReDoS
     private static partial Regex CheckRGBString();
 }

src/Core/Components/Tooltip/FluentTooltip.razor.cs

@@ -43,7 +43,6 @@ public partial class FluentTooltip : FluentComponentBase, IDisposable
     /// </summary>
     protected virtual TooltipGlobalOptions? GlobalOptions => TooltipService?.GlobalOptions;
 
-
     /// <summary>
     /// Gets or sets the text used on aria-label attribute.
     /// </summary>

src/Core/Components/TreeView/FluentTreeItem.razor.cs

@@ -210,21 +210,22 @@ internal static RenderFragment GetFluentTreeItem(FluentTreeView owner, ITreeView
     {
         RenderFragment fluentTreeItem = builder =>
         {
-            int i = 0;
-            builder.OpenComponent<FluentTreeItem>(i++);
-            builder.AddAttribute(i++, "Id", item.Id);
-            builder.AddAttribute(i++, "Items", item.Items);
-            builder.AddAttribute(i++, "Text", item.Text);
-            builder.AddAttribute(i++, "InitiallySelected", owner.SelectedItem == item);
-            builder.AddAttribute(i++, "Expanded", item.Expanded);
-            builder.AddAttribute(i++, "Disabled", item.Disabled);
-            builder.AddAttribute(i++, "IconCollapsed", item.IconCollapsed);
-            builder.AddAttribute(i++, "IconExpanded", item.IconExpanded);
+            //Don't use calculation or counter for building sequence numbers
+            //See: https://learn.microsoft.com/en-us/aspnet/core/blazor/advanced-scenarios?view=aspnetcore-9.0&utm_source=chatgpt.com#manually-build-a-render-tree-rendertreebuilder
+            builder.OpenComponent<FluentTreeItem>(0);
+            builder.AddAttribute(1, "Id", item.Id);
+            builder.AddAttribute(2, "Items", item.Items);
+            builder.AddAttribute(3, "Text", item.Text);
+            builder.AddAttribute(4, "InitiallySelected", owner.SelectedItem == item);
+            builder.AddAttribute(5, "Expanded", item.Expanded);
+            builder.AddAttribute(6, "Disabled", item.Disabled);
+            builder.AddAttribute(7, "IconCollapsed", item.IconCollapsed);
+            builder.AddAttribute(8, "IconExpanded", item.IconExpanded);
             builder.SetKey(item.Id);
 
             if (owner.ItemTemplate != null)
             {
-                builder.AddAttribute(i++, "ChildContent", owner.ItemTemplate(item));
+                builder.AddAttribute(9, "ChildContent", owner.ItemTemplate(item));
             }
 
             builder.CloseComponent();

src/Core/Components/Wizard/FluentWizard.razor.cs

@@ -238,7 +238,7 @@ protected virtual async Task<FluentWizardStepChangeEventArgs> OnStepChangeHandle
     /// <summary />
     protected virtual async Task OnFinishHandlerAsync(MouseEventArgs e)
     {
-        await this.FinishAsync(true);
+        await FinishAsync(true);
     }
 
     /// <summary>
@@ -332,10 +332,6 @@ private void SetCurrentStatusToStep(int stepIndex)
                 {
                     _steps[i].Status = WizardStepStatus.Current;
                 }
-                else if (i > stepIndex)
-                {
-                    _steps[i].Status = WizardStepStatus.Next;
-                }
                 else
                 {
                     _steps[i].Status = WizardStepStatus.Next;

src/Core/Utilities/CssBuilder.cs

@@ -123,6 +123,6 @@ private IEnumerable<string> SplitAndValidate(string input)
     /// Generates the regex used to validate CSS class names.
     /// </summary>
     /// <returns>A compiled regex for validating CSS class names</returns>
-    [GeneratedRegex(@"^-?[_a-zA-Z]+[_a-zA-Z0-9-]*$", RegexOptions.Compiled)]
+    [GeneratedRegex(@"^-?[_a-zA-Z]+[_a-zA-Z0-9-]*$", RegexOptions.Compiled, matchTimeoutMilliseconds: 1000)] //Add timeout to prevent ReDoS
     private static partial Regex GenerateValidClassNameRegex();
 }

src/Core/Utilities/Splitter.cs

@@ -86,7 +86,8 @@ internal static Memory<string> GetFragments(
         builder.Clear();
         _stringBuilderCached = builder;
 
-        var splits = Regex.Split(text, regex, caseSensitive ? RegexOptions.None : RegexOptions.IgnoreCase);
+        //Add timeout to prevent ReDoS
+        var splits = Regex.Split(text, regex, caseSensitive ? RegexOptions.None : RegexOptions.IgnoreCase, TimeSpan.FromSeconds(1));
 
         var length = 0;
         for (var i = 0; i < splits.Length; i++)