NicolaasWeideman / RegexStaticAnalysis

A tool to perform static analysis on regexes to determine whether they are vulnerable to ReDoS.
MIT License
109 stars 28 forks source link

Unicode Parsing #12

Open PAVAN-IS201401018 opened 5 years ago

PAVAN-IS201401018 commented 5 years ago

For the input \uFDCF it was skipped.

Unicode parsing has gone wrong in the code. In think here src/nfa/transitionlabel/TransitionLabelParserRecursive.java parseEscapedUnicodeCharacter() { consumeSymbol(); StringBuilder hexNumberStr = new StringBuilder();

    hexNumberStr.append(currentSymbol);
    for (int i = 0; i < 4; i++) {
        consumeSymbol();
        hexNumberStr.append(currentSymbol);         

    }

} You should consume 4 symbols to hexNumberStr but you used 5 symbols which led to out of MAX_16UNICODE range