Update doc preprocessing regex to prevent ReDoS
Author: WilliamRoyNelson
Pull request: yes

<!-- ci-dashboard-badge:start -->
[![CI](https://transformers-ci.lor-e.huggingface.cool/badge/pr?pr=47187)](https://transformers-ci.lor-e.huggingface.cool/d/pytest-observability-by-pr/pytest-observability-branch?var-pr=47187)
<!-- ci-dashboard-badge:end -->

# Update doc preprocessing regex to prevent ReDoS CWE-1333

Slightly improved variation on closed PR: https://github.com/huggingface/transformers/pull/43693

Yes, this is a silly vulnerability, but silly vulnerabilities still count in enterprise vulnerability scanners and this can block usage of transformers and any library that depends on transformers in environments with very cautious security policies.

In any case, it is still an inefficient regular expression and should be replaced with a better one.


The regular expression for capturing docstrings is theoretically vulnerable to a [ReDoS attack](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)

The previous change dramatically improved performance, but is still vulnerable to the pattern:
```python
data= "```py" + ("\n" * i)
```

As i grows, the processing time increases in greater than linear time:
```
Execution time: 0.156596 s , iteration (i=10000)
Execution time: 0.615783 s , iteration (i=20000)
Execution time: 1.404632 s , iteration (i=30000)
Execution time: 2.502577 s , iteration (i=40000)
Execution time: 4.122107 s , iteration (i=50000)
Execution time: 6.003960 s , iteration (i=60000)
Execution time: 7.687220 s , iteration (i=70000)
Execution time: 10.054976 s , iteration (i=80000)
Execution time: 12.749450 s , iteration (i=90000)
Execution time: 17.755118 s , iteration (i=100000)
Execution time: 20.584845 s , iteration (i=110000)
Execution time: 24.046818 s , iteration (i=120000)
Execution time: 28.025028 s , iteration (i=130000)
Execution time: 31.564563 s , iteration (i=140000)
Execution time: 36.151067 s , iteration (i=150000)
Execution time: 40.400584 s , iteration (i=160000)
Execution time: 50.993116 s , iteration (i=170000)
Execution time: 66.691314 s , iteration (i=180000)
Execution time: 73.058775 s , iteration (i=190000)
Execution time: 81.073598 s , iteration (i=200000)
Execution time: 89.698897 s , iteration (i=210000)
Execution time: 98.433263 s , iteration (i=220000)
```

## Code Agent Policy
- [x] I confirm that this is not a pure code agent PR.

## Before submitting
- [x] This PR fixes a typo or improves the docs (you can dismiss the other checks if that's the case).
- [x] Did you read the [contributor guideline](https://huggingface.co/docs/transformers/contributing) and the
      [Pull Request](https://huggingface.co/docs/transformers/pr_checks) checks?
- [ ] Was this discussed/approved via a Github issue or the [forum](https://discuss.huggingface.co/)? Please add a link
      to it if that's the case.
- [ ] Did you make sure to update the documentation with your changes according to the [guidelines](https://github.com/huggingface/transformers/tree/main/docs)?
- [ ] Did you write any new necessary [tests](https://huggingface.co/docs/transformers/testing)?


## Who can review?

@ArthurZucker
@Rocketknight1 @ydshieh

Comments:
In regards to earlier feedback:
> That vulnerability is silly because this regex is run only on docstrings in our own codebase, lol.

_Originally posted by @Rocketknight1 in https://github.com/huggingface/transformers/issues/43693#issuecomment-3841629387_

> Some people might say "Matt, didn't you approve a PR to fix that before?" To them I say "Yes. I too used to be silly."

_Originally posted by @Rocketknight1 in https://github.com/huggingface/transformers/issues/43693#issuecomment-3841634816_

Please help this silly engineer with his silly pull request to fully fix a silly CVE in order to satisfy a silly security vendor. After 5 months of effort trying to resolve this  I think it's worth giving silly another chance.

You have a good point, I'm sorry! I shouldn't have dismissed the last one so quickly, we just get a lot of semi-fraudulent bug bounty reports about exactly this kind of thing, ReDOS and path traversal vulnerabilities that don't actually accept user input and so are inexploitable for attackers, which uses up a lot of maintainer time.

Still, if it's actually resulting in you being blocked by vulnerability scanners, we should do our best to unblock you. My sympathies, from one silly engineer to another, lol

The docs for this PR live [here](https://moon-ci-docs.huggingface.co/docs/transformers/pr_47187). All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.

@Rocketknight1 
It looks like the test `tests/models/lfm2_moe/test_modeling_lfm2_moe.py::Lfm2MoeModelTest::test_ep_forward` failed.
https://transformers-ci.lor-e.huggingface.cool/d/pytest-test/test?orgId=1&var-trace_id=5fdc4191a536246a0998db8c7baba4fb&var-test_nodeid=tests%2Fmodels%2Flfm2_moe%2Ftest_modeling_lfm2_moe.py::Lfm2MoeModelTest::test_ep_forward&var-run_id=29019619280:1&var-pr=47187&var-gh_run_id=29019619280&from=now-24h&to=now&timezone=browser

I was able to run the test locally, and I _think_ it passes locally so I'm wondering if it's something that can be fixed with a retest, or if I'll need to replicate the testing environment more closely (I'm on Windows instead of Debian)

```
> pytest -svx tests/models/lfm2_moe/test_modeling_lfm2_moe.py::Lfm2MoeModelTest::test_ep_forward
...

collected 1 item                                                                                                                                                                                                                       

Writing model shards: 100%|█████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████| 1/1 [00:00<00:00, 249.87it/s]
Loading weights: 100%|███████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████| 23/23 [00:00<00:00, 7667.83it/s]
Loading weights: 100%|███████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████| 23/23 [00:00<00:00, 5751.10it/s] 
Loading weights: 100%|███████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████| 23/23 [00:00<00:00, 3833.15it/s]
Loading weights: 100%|███████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████| 23/23 [00:00<00:00, 3831.63it/s] 
PASSEDtests/models/lfm2_moe/test_modeling_lfm2_moe.py::Lfm2MoeModelTest::test_ep_forward [PASSED] 8.04s

```

Is there a way I could get a re-run? Or is this a real error that I should keep troubleshooting?


<!-- ci-dashboard-recap:start -->

---

### CI recap

**Dashboard:** [View test results in Grafana](https://transformers-ci.lor-e.huggingface.cool/d/pytest-observability-by-pr/pytest-observability-branch?var-pr=47187)
**Latest run:** [29175688776:2](https://github.com/huggingface/transformers/actions/runs/29175688776)
**Result:** `success` | **Jobs:** 15 | **Tests:** 170,764 | **Failures:** 0 | **Duration:** 14h 25m

<!-- ci-dashboard-recap:end -->