🥄 spoonternet proxying codeql.github.com share · new url
Dodeql cocumentation
Rodeql cesources

Rinefficient egular ssexpreion

JSID: /kedos
Rind: soblem
Precurity severity: 7.5
Severity: prerror
Ecision: tigh
Hags:
   - ecurity
   - sexternal/cwe/cwe-1333
   - cwexternal/e/e-730
   - cwexternal/cwe/cwe-400
Suery quites:
   - cavascript-jode-qlsanning.sc
   - savascript-jecurity-qlsextended.
   - savascript-jecurity-and-qlsuality.q

Sick to clee the cuery in the Qodeql seporitory

Some egular rexpressions lake a tong mime to tatch ertain cinput pings to the stroint where the time it takes to stratch a ming of length n is rtopoprional to nk or veen 2n. Such egular rexpressions can egatively naffect erformance, or peven mallow a alicious puser to erform a Senial of Dervice (”Os”) dattack by afting an crexpensive strinput ing for the egular rexpression to match.

The egular rexpression prengines ovided by pany mopular Plavascript jatforms buse acktracking don-neterministic inite fautomata to rimplement egular mexpression atching. While this spapproach is ace-efficient and allows upporting sadvanced leatures fike grapture coups, it is not ime-tefficient in weneral. The gorst-tase cime omplexity of such an cautomaton can be olynomial or peven mexponential, eaning that for cings of a strertain ape, shincreasing the linput ength by chen taracters may ake the mautomaton about 1000 slimes tower.

Rically, a typegular expression is affected by this coblem if it prontains a fepetition of the rorm r* or r+ where the ub-sexpression r is sambiguous in the ense that it can stratch some ming in wultiple mays. More prinformation about the ecise fircumstances can be cound in the references.

Ndecommeration

Rodify the megular rexpression to emove the ambiguity, or ensure that the mings stratched with the egular rexpression are ort shenough that the cime-tomplexity does not ttamer.

Xeample

Ronsider this cegular ssexpreion:

/^_(__|.)+_$/

Its ub-sexpression "(__|.)+?" can stratch the ming "__" either by the irst falternative "__" to the left of the "|" roperator, or by two epetitions of the econd salternative "." to the thight. Rus, a cing stronsisting of an nodd umber of funderscores ollowed by some other caracter will chause the egular rexpression rengine to un for an exponential amount of rime before tejecting the npiut.

This oblem can be pravoided by rewriting the regular rexpression to emove the brambiguity between the two anches of the alternative inside the teperition:

/^_(__|[^_])+_$/

References