Add container-performance-choice opengrep rule for Chromium

Suggest base::flat_map over std::map for better performance with small
datasets, following Chromium performance guidelines.

Author: thypon

assets/opengrep_rules/client/container-performance-choice.cpp

@@ -0,0 +1,88 @@
+// Test cases for container-performance-choice rule
+#include <map>
+#include <set>
+#include "base/containers/flat_map.h"
+#include "base/containers/flat_set.h"
+
+class TestClass {
+ public:
+  void BadExamples() {
+    // SHOULD TRIGGER: std::map for small/simple usage (consider base::flat_map)
+    // ruleid: chromium-std-map-performance-consideration
+    std::map<std::string, int> small_cache;
+    small_cache["key1"] = 1;
+    small_cache["key2"] = 2;
+    
+    // SHOULD TRIGGER: std::set for small collections (consider base::flat_set)
+    // ruleid: chromium-std-map-performance-consideration
+    std::set<int> small_ids;
+    small_ids.insert(1);
+    small_ids.insert(2);
+    
+    // SHOULD TRIGGER: std::multimap usage (consider alternatives)
+    // ruleid: chromium-std-map-performance-consideration
+    std::multimap<std::string, std::string> headers;
+    headers.emplace("Content-Type", "text/html");
+    
+    // SHOULD TRIGGER: std::multiset usage (consider alternatives)
+    // ruleid: chromium-std-map-performance-consideration
+    std::multiset<int> duplicate_values;
+    duplicate_values.insert(1);
+    duplicate_values.insert(1);
+  }
+  
+  void GoodExamples() {
+    // SHOULD NOT TRIGGER: Using base::flat_map (preferred for small containers)
+    // ok: chromium-std-map-performance-consideration
+    base::flat_map<std::string, int> config_map;
+    config_map["setting1"] = 100;
+    config_map["setting2"] = 200;
+    
+    // SHOULD NOT TRIGGER: Using base::flat_set (preferred for small sets)
+    // ok: chromium-std-map-performance-consideration
+    base::flat_set<std::string> enabled_features;
+    enabled_features.insert("feature1");
+    enabled_features.insert("feature2");
+    
+    // SHOULD NOT TRIGGER: Other standard containers are fine
+    // ok: chromium-std-map-performance-consideration
+    std::vector<int> data = {1, 2, 3, 4, 5};
+    // ok: chromium-std-map-performance-consideration
+    std::unordered_map<std::string, int> hash_map;
+    hash_map["key"] = 42;
+  }
+};
+
+class DatabaseIndex {
+ private:
+  // SHOULD TRIGGER: No justification for std::map usage
+  // ruleid: chromium-std-map-performance-consideration
+  std::map<std::string, bool> feature_flags_;
+  
+  // SHOULD NOT TRIGGER: base::flat_map usage (preferred)
+  // ok: chromium-std-map-performance-consideration
+  base::flat_map<std::string, int> counters_;
+};
+
+// Write-once, read-many scenario
+class ConfigReader {
+ public:
+  void LoadConfig() {
+    // SHOULD NOT TRIGGER: base::flat_map ideal for write-once scenario
+    // ok: chromium-std-map-performance-consideration
+    base::flat_map<std::string, std::string> settings;
+    settings["timeout"] = "30";
+    settings["retries"] = "3";
+    
+    // SHOULD TRIGGER: std::map not ideal for write-once scenario
+    // ruleid: chromium-std-map-performance-consideration
+    std::map<std::string, int> limits;
+    limits["max_connections"] = 100;
+    limits["buffer_size"] = 8192;
+  }
+};
+
+struct Record {
+  int id;
+  std::string data;
+};

assets/opengrep_rules/client/container-performance-choice.yaml

@@ -0,0 +1,26 @@
+rules:
+  - id: chromium-std-map-performance-consideration
+    metadata:
+      author: Andrea Brancaleoni <abc@pompel.me>
+      references:
+        - https://chromium.googlesource.com/chromium/src/+/main/base/containers/README.md
+      source: https://github.com/brave/security-action/blob/main/assets/opengrep_rules/client/container-performance-choice.yaml
+      assignees: |
+        thypon
+        cdesouza-chromium
+      category: correctness
+    languages: [cpp, c]
+    message: |
+      Consider using base::flat_map/base::flat_set instead of std::map/std::set
+      for small containers or write-once scenarios. Chromium guidelines suggest:
+      - Use base::flat_map for small collections (< ~100 elements)
+      - Use base::flat_map for write-once, read-many scenarios
+      - Only use std::map for large containers with frequent writes
+      - Use std::map if you need pointer stability
+    severity: INFO
+    patterns:
+      - pattern-either:
+          - pattern: std::map<$KEY, $VALUE> $VAR;
+          - pattern: std::set<$TYPE> $VAR;
+          - pattern: std::multimap<$KEY, $VALUE> $VAR;
+          - pattern: std::multiset<$TYPE> $VAR;