Skip to content

Commit 50cb5ea

Browse files
erik-krogherik-krogh
authored
Merge pull request #13164 from erik-krogh/polyQhelp
ReDoS: add another example to the qhelp in poly-redos, showing how to just limit the length of the input
2 parents e658177 + 710b309 commit 50cb5ea

File tree

4 files changed

+115
-16
lines changed

4 files changed

+115
-16
lines changed

‎java/ql/src/Security/CWE/CWE-730/PolynomialReDoS.qhelp‎

Lines changed: 29 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,7 @@
1515
</p>
1616

1717
<sample language="java">
18-
Pattern.compile("^\\s+|\\s+$").matcher(text).replaceAll("") // BAD
19-
</sample>
18+
Pattern.compile("^\\s+|\\s+$").matcher(text).replaceAll("") // BAD</sample>
2019

2120
<p>
2221

@@ -71,8 +70,7 @@
7170
</p>
7271

7372
<sample language="java">
74-
"^0\\.\\d+E?\\d+$""
75-
</sample>
73+
"^0\\.\\d+E?\\d+$"" </sample>
7674

7775
<p>
7876

@@ -103,6 +101,33 @@
103101

104102
</example>
105103

104+
<example>
105+
<p>
106+
Sometimes it is unclear how a regular expression can be rewritten to
107+
avoid the problem. In such cases, it often suffices to limit the
108+
length of the input string. For instance, the following
109+
regular expression is used to match numbers, and on some non-number
110+
inputs it can have quadratic time complexity:
111+
</p>
112+
113+
<sample language="java">
114+
Pattern.matches("^(\\+|-)?(\\d+|(\\d*\\.\\d*))?(E|e)?([-+])?(\\d+)?$", str); </sample>
115+
116+
<p>
117+
It is not immediately obvious how to rewrite this regular expression
118+
to avoid the problem. However, you can mitigate performance issues by limiting the length
119+
to 1000 characters, which will always finish in a reasonable amount
120+
of time.
121+
</p>
122+
123+
<sample language="java">
124+
if (str.length() &gt; 1000) {
125+
throw new IllegalArgumentException("Input too long");
126+
}
127+
128+
Pattern.matches("^(\\+|-)?(\\d+|(\\d*\\.\\d*))?(E|e)?([-+])?(\\d+)?$", str); </sample>
129+
</example>
130+
106131
<include src="ReDoSReferences.inc.qhelp"/>
107132

108133
</qhelp>

‎javascript/ql/src/Performance/PolynomialReDoS.qhelp‎

Lines changed: 29 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,7 @@
1515
</p>
1616

1717
<sample language="javascript">
18-
text.replace(/^\s+|\s+$/g, ''); // BAD
19-
</sample>
18+
text.replace(/^\s+|\s+$/g, ''); // BAD</sample>
2019

2120
<p>
2221

@@ -71,8 +70,7 @@
7170
</p>
7271

7372
<sample language="javascript">
74-
/^0\.\d+E?\d+$/.test(str) // BAD
75-
</sample>
73+
/^0\.\d+E?\d+$/.test(str) // BAD</sample>
7674

7775
<p>
7876

@@ -103,6 +101,33 @@
103101

104102
</example>
105103

104+
<example>
105+
<p>
106+
Sometimes it is unclear how a regular expression can be rewritten to
107+
avoid the problem. In such cases, it often suffices to limit the
108+
length of the input string. For instance, the following
109+
regular expression is used to match numbers, and on some non-number
110+
inputs it can have quadratic time complexity:
111+
</p>
112+
113+
<sample language="javascript">
114+
/^(\+|-)?(\d+|(\d*\.\d*))?(E|e)?([-+])?(\d+)?$/.test(str) // BAD</sample>
115+
116+
<p>
117+
It is not immediately obvious how to rewrite this regular expression
118+
to avoid the problem. However, you can mitigate performance issues by limiting the length
119+
to 1000 characters, which will always finish in a reasonable amount
120+
of time.
121+
</p>
122+
123+
<sample language="javascript">
124+
if (str.length &gt; 1000) {
125+
throw new Error("Input too long");
126+
}
127+
128+
/^(\+|-)?(\d+|(\d*\.\d*))?(E|e)?([-+])?(\d+)?$/.test(str)</sample>
129+
</example>
130+
106131
<include src="ReDoSReferences.inc.qhelp"/>
107132

108133
</qhelp>

‎python/ql/src/Security/CWE-730/PolynomialReDoS.qhelp‎

Lines changed: 28 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,7 @@
1515
</p>
1616

1717
<sample language="python">
18-
re.sub(r"^\s+|\s+$", "", text) # BAD
19-
</sample>
18+
re.sub(r"^\s+|\s+$", "", text) # BAD</sample>
2019

2120
<p>
2221

@@ -71,8 +70,7 @@
7170
</p>
7271

7372
<sample language="python">
74-
^0\.\d+E?\d+$ # BAD
75-
</sample>
73+
^0\.\d+E?\d+$ # BAD</sample>
7674

7775
<p>
7876

@@ -103,6 +101,32 @@
103101

104102
</example>
105103

104+
<example>
105+
<p>
106+
Sometimes it is unclear how a regular expression can be rewritten to
107+
avoid the problem. In such cases, it often suffices to limit the
108+
length of the input string. For instance, the following
109+
regular expression is used to match numbers, and on some non-number
110+
inputs it can have quadratic time complexity:
111+
</p>
112+
113+
<sample language="python">
114+
match = re.search(r'^(\+|-)?(\d+|(\d*\.\d*))?(E|e)?([-+])?(\d+)?$', str) </sample>
115+
116+
<p>
117+
It is not immediately obvious how to rewrite this regular expression
118+
to avoid the problem. However, you can mitigate performance issues by limiting the length
119+
to 1000 characters, which will always finish in a reasonable amount
120+
of time.
121+
</p>
122+
123+
<sample language="python">
124+
if len(str) &gt; 1000:
125+
raise ValueError("Input too long")
126+
127+
match = re.search(r'^(\+|-)?(\d+|(\d*\.\d*))?(E|e)?([-+])?(\d+)?$', str) </sample>
128+
</example>
129+
106130
<include src="ReDoSReferences.inc.qhelp"/>
107131

108132
</qhelp>

‎ruby/ql/src/queries/security/cwe-1333/PolynomialReDoS.qhelp‎

Lines changed: 29 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,7 @@
1515
</p>
1616

1717
<sample language="ruby">
18-
text.gsub!(/^\s+|\s+$/, '') # BAD
19-
</sample>
18+
text.gsub!(/^\s+|\s+$/, '') # BAD</sample>
2019

2120
<p>
2221

@@ -74,8 +73,7 @@
7473
</p>
7574

7675
<sample language="ruby">
77-
/^0\.\d+E?\d+$/ # BAD
78-
</sample>
76+
/^0\.\d+E?\d+$/ # BAD</sample>
7977

8078
<p>
8179

@@ -108,6 +106,33 @@
108106

109107
</example>
110108

109+
<example>
110+
<p>
111+
Sometimes it is unclear how a regular expression can be rewritten to
112+
avoid the problem. In such cases, it often suffices to limit the
113+
length of the input string. For instance, the following
114+
regular expression is used to match numbers, and on some non-number
115+
inputs it can have quadratic time complexity:
116+
</p>
117+
118+
<sample language="ruby">
119+
is_matching = /^(\+|-)?(\d+|(\d*\.\d*))?(E|e)?([-+])?(\d+)?$/.match?(str)</sample>
120+
121+
<p>
122+
It is not immediately obvious how to rewrite this regular expression
123+
to avoid the problem. However, you can mitigate performance issues by limiting the length
124+
to 1000 characters, which will always finish in a reasonable amount
125+
of time.
126+
</p>
127+
128+
<sample language="ruby">
129+
if str.length &gt; 1000
130+
raise ArgumentError, "Input too long"
131+
end
132+
133+
is_matching = /^(\+|-)?(\d+|(\d*\.\d*))?(E|e)?([-+])?(\d+)?$/.match?(str)</sample>
134+
</example>
135+
111136
<include src="ReDoSReferences.inc.qhelp"/>
112137

113138
</qhelp>

0 commit comments

Comments
 (0)