search

tjenkinson / redos-detector

A CLI and library which tests with certainty if a regex pattern is safe from ReDoS attacks. Supported in the browser, Node and Deno.
https://redosdetector.com
MIT License
43 stars 4 forks source link

Possible missing case #606

Closed TrueWill closed 1 month ago

TrueWill commented 1 month ago

The first example from https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS is considered safe by isSafePattern: (a+)+

tjenkinson commented 1 month ago

Hey @TrueWill thanks for flagging. That should be unsafe.

Unfortunately this tool currently misses some cases when there's no start anchor.

If you prepend ^.* you'll see the failure.

I've been working on a fix and hopefully will have it ready soon