checkSQLInjectionRisks and InjectAndConditions compiled their regexps
with regexp.MustCompile on every invocation. Both run on the datasource
SQL path — InjectAndConditions is called once per security filter
(tenant, soft-delete, hidden-KB, search-scope), so a single secured query
recompiled ~20 patterns. InjectAndConditions also compiled the identical
tail-clause pattern twice.
Hoist them to package-level vars (compiled once at init). Behavior is
unchanged — same patterns, covered by the existing TestValidateSQL_*
and TestInjectAndConditions tests.
Benchmarks (apple M, -benchmem):
InjectAndConditions 4347 ns, 72 allocs -> 1023 ns, 7 allocs
checkSQLInjectionRisks 36074 ns, 560 allocs -> 12984 ns, 12 allocs
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
adawang
3b317f7eef