davisjam / vuln-regex-detector

Detect vulnerable regexes in your project. REDOS, catastrophic backtracking.
MIT License
320 stars 29 forks source link

Add ReScue #58

Closed davisjam closed 5 years ago

davisjam commented 5 years ago

Add ReScue to the ensemble.

ReScue is a super-linear regex detector published at ASE 2018 by Shen et al. It works on a different principle from the existing three: it is dynamic, not static.

The shen-ReScue submodule currently points at my ReScue fork, specifically the branch here that adds input/output that matches the vuln-regex-detector spec. Once ReScue #6 lands, the submodule should be pointed at the 2bdenny/ReScue mainline to pick up future improvements.

Fixes: #53