davisjam / vuln-regex-detector

Detect vulnerable regexes in your project. REDOS, catastrophic backtracking.
MIT License
320 stars 29 forks source link

validation: discount time spent building attack string #52

Open davisjam opened 6 years ago

davisjam commented 6 years ago

Currently the timeout is applied on a process level. In some languages building a long query string is expensive and can lead to a timeout, although the regex match itself is fast.

A fix would be to have the callee indicate to the caller when it is beginning the regex match so that the caller can start a timeout then.

I do not think any of the languages currently supported in this repository have slow string building times, since they are all "scripting" languages that prioritize string operations. However, I have a work-in-progress C# version that does have this problem. At any rate, to avoid false positives the fix indicated above should be applied.