js/weak-cryptographic-algorithm/BrokenCryptoAlgorithm got 25-30x slower

[maschwenk]

Description of the issue

Similar to

• RegExpInjection takes 6 hours to scan the TypeScript repo after 2.20.2 #18584

this rule appears to run 20-30x slower on the same exact repo with the same hardware

[106/106 eval 30m34s] Evaluation done; writing results to codeql/javascript-queries/Security/CWE-327/BrokenCryptoAlgorithm.bqrs.

unsure root cause is the same as the other issue, but disabling rule rule like

query-filters:
  - exclude:
      id: js/weak-cryptographic-algorithm

is a workaround

[asgerf]

Hi @maschwenk, thanks for the report.

If you've seen this on a public repository could you share a link to the repository?

[maschwenk]

Sadly not public, and unsure of how to give a repro. Failing on a very large 20k+ LoC typescript app.