davisjam / vuln-regex-detector

Detect vulnerable regexes in your project. REDOS, catastrophic backtracking.
MIT License
320 stars 29 forks source link

detect: rxxr2 parser mis-handled empty suggestions #50

Closed davisjam closed 6 years ago

davisjam commented 6 years ago

Problem: When no suffix or no prefix is required, rxxr2 emits an empty string. The output parsing regex was looking for '(.+)' which rejects the empty string.

Solution: Switch to '(.*)'.

Test: I added a new test case. However, it appears that run-tests.pl is not precise enough to notice the parse failure. This is unfortunate.