From 97de072e7ff5f91d5b5494b78c409ce31bfde3b1 Mon Sep 17 00:00:00 2001 From: Ruben Fiszel Date: Wed, 28 Oct 2026 22:31:08 +0100 Subject: [PATCH] perf: build log-mask automaton as a contiguous nfa (#12088) Co-authored-by: Claude Opus 5.5 --- backend/windmill-common/src/sensitive_log_masks.rs | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/backend/windmill-common/src/sensitive_log_masks.rs b/backend/windmill-common/src/sensitive_log_masks.rs index c999297ec0..f01ca2427e 100644 --- a/backend/windmill-common/src/sensitive_log_masks.rs +++ b/backend/windmill-common/src/sensitive_log_masks.rs @@ -184,7 +184,11 @@ fn compile(secrets: &HashSet) -> CompiledMasks { }) .collect(); + // Built once per job (its token is always a secret) and searched over little log text, so + // the default DFA's build cost dominates; a contiguous NFA searches as fast here since + // the literal prefilter does the scanning. let ac = aho_corasick::AhoCorasickBuilder::new() + .kind(Some(aho_corasick::AhoCorasickKind::ContiguousNFA)) .match_kind(aho_corasick::MatchKind::LeftmostLongest) .build(sorted.iter().map(|s| s.as_str())) .expect("failed to build aho-corasick automaton");