Incomplete remediation of CVE-2021-27291: ScalaLexer ReDoS still present in 2.20.0

Incomplete remediation of CVE-2021-27291 / CVE-2021-20272: ScalaLexer ReDoS still present in Pygments 2.20.0

Summary

A catastrophic-regex (ReDoS) hang remains in the ScalaLexer (jvm.py) of the current Pygments release (2.20.0). This is the same string-literal ReDoS class that was fixed across ~25 lexers in 2.7.4 for CVE-2021-27291 / CVE-2021-20272, but the scala string-escape lexing path was missed (incomplete remediation — a surviving unpatched sibling).

Minimal repro

from pygments.lexers import get_lexer_by_name
from pygments import highlight
from pygments.formatters import NullFormatter
lex = get_lexer_by_name("scala")
highlight(b'"' + b"\\\\" * 48, lex, NullFormatter())   # unterminated double-quoted string of 48 backslashes

Timing (single core, Python 3.12)

Backslash-dependent, super-exponential with N, requires the unterminated (forced-backtrack) form. A ~50-byte input hangs the highlighter.

Class / causality

The hang is catastrophic regex backtracking in the scala string backslash-escape lexing on an unterminated quote. The 2.7.4 CVE fix replaced the ambiguous (\\\\|\\"|[^"])* family with the linear-safe (\\\\|\\[^\\\\]|[^"\\\\])* form in the reported lexers; the scala string/escape path (jvm.py ScalaLexer) does not appear to use the hardened form for this sub-state. Maintainer triage is requested to locate the exact regex in the ScalaLexer string states (I could not isolate a single standalone-compiling token — it manifests only through the lexer's incremental per-position matching).

Proposed fix (2.7.4-style)

Harden the scala string backslash-escape regex to the non-overlapping form, e.g. replace
\\\.? / ambiguous (\\\\|\\"|[^"])* patterns with the atomic-safe
(\\\\|\\[^\\\\]|[^"\\\\])* or add (?>...) / possessive quantifiers so backslashes cannot be re-partitioned.

Regression test (timing)

Assert that lexing b'"' + b'\\\\'*512 (unterminated) completes in well under 1s in CI for the scala lexer.

Start with jvm.py and the ScalaLexer string states, using the get_lexer_by_name("scala") and highlight() reproduction from the issue. Trace the unterminated backslash-heavy input, then add a regression test showing that 512 backslashes complete promptly. Done means the ScalaLexer no longer exhibits catastrophic backtracking while normal string lexing remains covered.