NicolaasWeideman / RegexStaticAnalysis

A tool to perform static analysis on regexes to determine whether they are vulnerable to ReDoS.
MIT License
109 stars 28 forks source link

Support boundary \b #9

Open davisjam opened 6 years ago

davisjam commented 6 years ago

This pattern is vulnerable but unsupported. I suspect the issue is the \b near the end, on which Wustholz chokes.

{"pattern":"^( {0,3}> ?(([^\\n]+(?:\\n?(?! {0,3}((?:- *){3,}|(?:_ *){3,}|(?:\\* *){3,})(?:\\n+|$)| *(#{1,6}) *([^\\n]+?) *#* *(?:\\n+|$)|([^\\n]+)\\n *(=|-){2,} *(?:\\n+|$)| {0,3}>|<(?!(?:a|em|strong|small|s|cite|q|dfn|abbr|data|time|code|var|samp|kbd|sub|sup|i|b|u|mark|ruby|rt|rp|bdi|bdo|span|br|wbr|ins|del|img)\\b)\\w+(?!:|[^\\w\\s@]*@)\\b)[^\\n]+)+)|[^\\n]*)(?:\\n|$))+"}
davisjam commented 6 years ago

/cc @ChALkeR FYI