import re
import time
COUNT = 100
for re_text, name in [
(r"(\d+): S_IFREG.*\s*.*name:(.*)\n", "current"),
(r"(\d+): S_IFREG.*name:(.*)\n", "fixed"),
]:
begin_at = time.time()
for _ in range(COUNT):
re.findall(re_text, "S_IFREG' + ' ' * 150")
print(f"Total for {name:8} is {time.time() - begin_at:.6f}")
My output is below
Total for current is 0.000119
Total for fixed is 0.000031
Improves speed from exponential on bad strings like
"S_IFREG' + ' ' * 150"
to polynomial.Summary
Description
Current RegExp is vulnerable to ReDoS.
POC for regexps is below:
My output is below