fix: parse actor identities without regular expressions

GHSA-g5vv-9gxw-82hx reports quadratic backtracking when an actor
identity contains a long unterminated email delimiter.

Add a regression that exercises a 20,000-character malformed identity,
then replace both actor regexes with direct delimiter scans. This keeps
the existing well-formed, multiline, and fallback results while making
the work linear in input length.

Reference Git baseline cf5497b14c5a24f10c13f7e0ee85cb95
ident.c::split_ident_line and its invalid-committer cases in
t/t9300-fast-import.sh. Also reference gix-actor's signature decoder and
lenient identity tests.

Validation:
- test/test_actor.py: 6 passed
- TestUtils::test_actor_from_string passes
- ruff check and format pass

Author: codex

git/util.py

@@ -858,10 +858,6 @@ class Actor:
     committers and authors or anything with a name and an email as mentioned in the git
     log entries."""
 
-    # PRECOMPILED REGEX
-    name_only_regex = re.compile(r"<(.*)>")
-    name_email_regex = re.compile(r"(.*) <(.*?)>")
-
     # ENVIRONMENT VARIABLES
     # These are read when creating new commits.
     env_author_name = "GIT_AUTHOR_NAME"
@@ -906,18 +902,22 @@ def _from_string(cls, string: str) -> "Actor":
         :return:
             :class:`Actor`
         """
-        m = cls.name_email_regex.search(string)
-        if m:
-            name, email = m.groups()
-            return Actor(name, email)
-        else:
-            m = cls.name_only_regex.search(string)
-            if m:
-                return Actor(m.group(1), None)
-            # Assume the best and use the whole string as name.
-            return Actor(string, None)
-            # END special case name
-        # END handle name/email matching
+        lines = string.split("\n")
+        for line in lines:
+            right_bracket = line.rfind(">")
+            left_bracket = line.rfind(" <", 0, right_bracket) if right_bracket >= 0 else -1
+            if left_bracket >= 0:
+                email_end = line.find(">", left_bracket + 2)
+                return Actor(line[:left_bracket], line[left_bracket + 2 : email_end])
+
+        for line in lines:
+            left_bracket = line.find("<")
+            right_bracket = line.rfind(">")
+            if 0 <= left_bracket < right_bracket:
+                return Actor(line[left_bracket + 1 : right_bracket], None)
+
+        # Assume the best and use the whole string as name.
+        return Actor(string, None)
 
     @classmethod
     def _main_actor(

test/test_actor.py

@@ -27,6 +27,15 @@ def test_from_string_should_handle_just_name(self):
         self.assertEqual("Michael Trier", a.name)
         self.assertEqual(None, a.email)
 
+    def test_from_string_handles_unterminated_email_without_regex_backtracking(self):
+        value = "A" * 20_000 + " <unterminated"
+        actor = Actor._from_string(value)
+        self.assertNotIn("name_email_regex", vars(Actor))
+        self.assertEqual(actor, Actor(value, None))
+
+    def test_from_string_does_not_parse_across_lines(self):
+        self.assertEqual(Actor._from_string("x <a>\n y <b>"), Actor("x", "a"))
+
     def test_should_display_representation(self):
         a = Actor._from_string("Michael Trier <mtrier@example.com>")
         self.assertEqual('<git.Actor "Michael Trier <mtrier@example.com>">', repr(a))