class

Flaw::RegexRedos

Inherits Flaw::Rule < Reference < Object

FLAW017 — Regex with nested quantifiers and alternation. Catastrophic backtracking candidate. Only a heuristic — true ReDoS requires an engine simulation, but the shape (a+)+, (a|a)+, (a*)* is a strong tell.

Constants

PATTERN = /\/[^\/\n]*\([^)]*[+*][^)]*\)[+*][^\/\n]*\//

/(<quant>)<outer_quant>/ where quant contains + or *

Instance methods

check(source : String, path : String) : Array(Finding)

default_severity

description

title