Use a timeout when validating NuGet package id

Author: kartheekp-ms

src/NuGet.Core/NuGet.Packaging/PackageCreation/Utility/PackageIdValidator.cs

@@ -11,7 +11,9 @@ namespace NuGet.Packaging
     public static class PackageIdValidator
     {
         public const int MaxPackageIdLength = 100;
-        private static readonly Regex IdRegex = new Regex(@"^\w+([_.-]\w+)*$", RegexOptions.IgnoreCase | RegexOptions.ExplicitCapture | RegexOptions.CultureInvariant);
+        private static readonly Regex IdRegex = new Regex(pattern: @"^\w+([.-]\w+)*$",
+            options: RegexOptions.IgnoreCase | RegexOptions.ExplicitCapture | RegexOptions.CultureInvariant,
+            matchTimeout: TimeSpan.FromSeconds(10));
 
         public static bool IsValidPackageId(string packageId)
         {

test/NuGet.Core.Tests/NuGet.Packaging.Test/PackageIdValidatorTest.cs

@@ -159,6 +159,32 @@ public void DotToolsIsNotAllowed()
             Assert.False(isValid);
         }
 
+        [Fact]
+        public void IsValidPackageId_PackageIdWithTwoUnderscores_Success()
+        {
+            // Arrange
+            string packageId = "Hello__World";
+
+            // Act
+            bool isValid = PackageIdValidator.IsValidPackageId(packageId);
+
+            // Assert
+            Assert.True(isValid);
+        }
+
+        [Fact]
+        public void IsValidPackageId_LongPackageIdWithUnMatchedCharAtTheEnd_Fails()
+        {
+            // Arrange
+            string packageId = string.Concat(new string('_', 100), "!");
+
+            // Act
+            bool isValid = PackageIdValidator.IsValidPackageId(packageId);
+
+            // Assert
+            Assert.False(isValid);
+        }
+
         [Theory]
         [InlineData(101)]
         [InlineData(102)]