Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 10aab81

Browse files
erik-krogherik-krogh
authored
Merge pull request #10799 from jsoref/spelling-nfautils
ReDoS: Spelling nfautils
2 parents c3af41b + 09c8a98 commit 10aab81

7 files changed

Lines changed: 41 additions & 37 deletions

File tree

‎java/ql/lib/semmle/code/java/security/regexp/NfaUtils.qll‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -59,8 +59,8 @@ predicate matchesEpsilon(RegExpTerm t) {
5959
/**
6060
* A lookahead/lookbehind that matches the empty string.
6161
*/
62-
class EmptyPositiveSubPatttern extends RegExpSubPattern {
63-
EmptyPositiveSubPatttern() {
62+
class EmptyPositiveSubPattern extends RegExpSubPattern {
63+
EmptyPositiveSubPattern() {
6464
(
6565
this instanceof RegExpPositiveLookahead
6666
or
@@ -70,6 +70,9 @@ class EmptyPositiveSubPatttern extends RegExpSubPattern {
7070
}
7171
}
7272

73+
/** DEPRECATED: Use `EmptyPositiveSubPattern` instead. */
74+
deprecated class EmptyPositiveSubPatttern = EmptyPositiveSubPattern;
75+
7376
/**
7477
* A branch in a disjunction that is the root node in a literal, or a literal
7578
* whose root node is not a disjunction.
@@ -133,7 +136,7 @@ private predicate isCanonicalTerm(RelevantRegExpTerm term, string str) {
133136
}
134137

135138
/**
136-
* Gets a string reperesentation of the flags used with the regular expression.
139+
* Gets a string representation of the flags used with the regular expression.
137140
* Only the flags that are relevant for the canonicalization are included.
138141
*/
139142
string getCanonicalizationFlags(RegExpTerm root) {
@@ -334,7 +337,7 @@ private module CharacterClasses {
334337
)
335338
}
336339

337-
private string lowercaseLetter() { result = "abdcefghijklmnopqrstuvwxyz".charAt(_) }
340+
private string lowercaseLetter() { result = "abcdefghijklmnopqrstuvwxyz".charAt(_) }
338341

339342
private string upperCaseLetter() { result = "ABCDEFGHIJKLMNOPQRSTUVWXYZ".charAt(_) }
340343

@@ -697,9 +700,7 @@ predicate delta(State q1, EdgeLabel lbl, State q2) {
697700
lbl = Epsilon() and q2 = Accept(getRoot(dollar))
698701
)
699702
or
700-
exists(EmptyPositiveSubPatttern empty | q1 = before(empty) |
701-
lbl = Epsilon() and q2 = after(empty)
702-
)
703+
exists(EmptyPositiveSubPattern empty | q1 = before(empty) | lbl = Epsilon() and q2 = after(empty))
703704
}
704705

705706
/**
@@ -1028,7 +1029,7 @@ module ReDoSPruning<isCandidateSig/2 isCandidate> {
10281029
* as the suffix "X" will cause both the regular expressions to be rejected.
10291030
*
10301031
* The string `w` is repeated any number of times because it needs to be
1031-
* infinitely repeatedable for the attack to work.
1032+
* infinitely repeatable for the attack to work.
10321033
* For the regular expression `/((ab)+)*abab/` the accepting state is not reachable from the fork
10331034
* using epsilon transitions. But any attempt at repeating `w` will end in a state that accepts all suffixes.
10341035
*/

‎javascript/ql/lib/semmle/javascript/security/regexp/NfaUtils.qll‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -59,8 +59,8 @@ predicate matchesEpsilon(RegExpTerm t) {
5959
/**
6060
* A lookahead/lookbehind that matches the empty string.
6161
*/
62-
class EmptyPositiveSubPatttern extends RegExpSubPattern {
63-
EmptyPositiveSubPatttern() {
62+
class EmptyPositiveSubPattern extends RegExpSubPattern {
63+
EmptyPositiveSubPattern() {
6464
(
6565
this instanceof RegExpPositiveLookahead
6666
or
@@ -70,6 +70,9 @@ class EmptyPositiveSubPatttern extends RegExpSubPattern {
7070
}
7171
}
7272

73+
/** DEPRECATED: Use `EmptyPositiveSubPattern` instead. */
74+
deprecated class EmptyPositiveSubPatttern = EmptyPositiveSubPattern;
75+
7376
/**
7477
* A branch in a disjunction that is the root node in a literal, or a literal
7578
* whose root node is not a disjunction.
@@ -133,7 +136,7 @@ private predicate isCanonicalTerm(RelevantRegExpTerm term, string str) {
133136
}
134137

135138
/**
136-
* Gets a string reperesentation of the flags used with the regular expression.
139+
* Gets a string representation of the flags used with the regular expression.
137140
* Only the flags that are relevant for the canonicalization are included.
138141
*/
139142
string getCanonicalizationFlags(RegExpTerm root) {
@@ -334,7 +337,7 @@ private module CharacterClasses {
334337
)
335338
}
336339

337-
private string lowercaseLetter() { result = "abdcefghijklmnopqrstuvwxyz".charAt(_) }
340+
private string lowercaseLetter() { result = "abcdefghijklmnopqrstuvwxyz".charAt(_) }
338341

339342
private string upperCaseLetter() { result = "ABCDEFGHIJKLMNOPQRSTUVWXYZ".charAt(_) }
340343

@@ -697,9 +700,7 @@ predicate delta(State q1, EdgeLabel lbl, State q2) {
697700
lbl = Epsilon() and q2 = Accept(getRoot(dollar))
698701
)
699702
or
700-
exists(EmptyPositiveSubPatttern empty | q1 = before(empty) |
701-
lbl = Epsilon() and q2 = after(empty)
702-
)
703+
exists(EmptyPositiveSubPattern empty | q1 = before(empty) | lbl = Epsilon() and q2 = after(empty))
703704
}
704705

705706
/**
@@ -1028,7 +1029,7 @@ module ReDoSPruning<isCandidateSig/2 isCandidate> {
10281029
* as the suffix "X" will cause both the regular expressions to be rejected.
10291030
*
10301031
* The string `w` is repeated any number of times because it needs to be
1031-
* infinitely repeatedable for the attack to work.
1032+
* infinitely repeatable for the attack to work.
10321033
* For the regular expression `/((ab)+)*abab/` the accepting state is not reachable from the fork
10331034
* using epsilon transitions. But any attempt at repeating `w` will end in a state that accepts all suffixes.
10341035
*/

‎javascript/ql/lib/semmle/javascript/security/regexp/NfaUtilsSpecific.qll‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
import javascript
66

77
/**
8-
* Holds if `term` is an ecape class representing e.g. `\d`.
8+
* Holds if `term` is an escape class representing e.g. `\d`.
99
* `clazz` is which character class it represents, e.g. "d" for `\d`.
1010
*/
1111
predicate isEscapeClass(RegExpTerm term, string clazz) {
@@ -20,13 +20,13 @@ predicate isPossessive(RegExpQuantifier term) { none() }
2020

2121
/**
2222
* Holds if the regex that `term` is part of is used in a way that ignores any leading prefix of the input it's matched against.
23-
* Not yet implemented for Javascript.
23+
* Not yet implemented for JavaScript.
2424
*/
2525
predicate matchesAnyPrefix(RegExpTerm term) { any() }
2626

2727
/**
2828
* Holds if the regex that `term` is part of is used in a way that ignores any trailing suffix of the input it's matched against.
29-
* Not yet implemented for Javascript.
29+
* Not yet implemented for JavaScript.
3030
*/
3131
predicate matchesAnySuffix(RegExpTerm term) { any() }
3232

‎python/ql/lib/semmle/python/security/regexp/NfaUtils.qll‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -59,8 +59,8 @@ predicate matchesEpsilon(RegExpTerm t) {
5959
/**
6060
* A lookahead/lookbehind that matches the empty string.
6161
*/
62-
class EmptyPositiveSubPatttern extends RegExpSubPattern {
63-
EmptyPositiveSubPatttern() {
62+
class EmptyPositiveSubPattern extends RegExpSubPattern {
63+
EmptyPositiveSubPattern() {
6464
(
6565
this instanceof RegExpPositiveLookahead
6666
or
@@ -70,6 +70,9 @@ class EmptyPositiveSubPatttern extends RegExpSubPattern {
7070
}
7171
}
7272

73+
/** DEPRECATED: Use `EmptyPositiveSubPattern` instead. */
74+
deprecated class EmptyPositiveSubPatttern = EmptyPositiveSubPattern;
75+
7376
/**
7477
* A branch in a disjunction that is the root node in a literal, or a literal
7578
* whose root node is not a disjunction.
@@ -133,7 +136,7 @@ private predicate isCanonicalTerm(RelevantRegExpTerm term, string str) {
133136
}
134137

135138
/**
136-
* Gets a string reperesentation of the flags used with the regular expression.
139+
* Gets a string representation of the flags used with the regular expression.
137140
* Only the flags that are relevant for the canonicalization are included.
138141
*/
139142
string getCanonicalizationFlags(RegExpTerm root) {
@@ -334,7 +337,7 @@ private module CharacterClasses {
334337
)
335338
}
336339

337-
private string lowercaseLetter() { result = "abdcefghijklmnopqrstuvwxyz".charAt(_) }
340+
private string lowercaseLetter() { result = "abcdefghijklmnopqrstuvwxyz".charAt(_) }
338341

339342
private string upperCaseLetter() { result = "ABCDEFGHIJKLMNOPQRSTUVWXYZ".charAt(_) }
340343

@@ -697,9 +700,7 @@ predicate delta(State q1, EdgeLabel lbl, State q2) {
697700
lbl = Epsilon() and q2 = Accept(getRoot(dollar))
698701
)
699702
or
700-
exists(EmptyPositiveSubPatttern empty | q1 = before(empty) |
701-
lbl = Epsilon() and q2 = after(empty)
702-
)
703+
exists(EmptyPositiveSubPattern empty | q1 = before(empty) | lbl = Epsilon() and q2 = after(empty))
703704
}
704705

705706
/**
@@ -1028,7 +1029,7 @@ module ReDoSPruning<isCandidateSig/2 isCandidate> {
10281029
* as the suffix "X" will cause both the regular expressions to be rejected.
10291030
*
10301031
* The string `w` is repeated any number of times because it needs to be
1031-
* infinitely repeatedable for the attack to work.
1032+
* infinitely repeatable for the attack to work.
10321033
* For the regular expression `/((ab)+)*abab/` the accepting state is not reachable from the fork
10331034
* using epsilon transitions. But any attempt at repeating `w` will end in a state that accepts all suffixes.
10341035
*/

‎python/ql/lib/semmle/python/security/regexp/NfaUtilsSpecific.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ import python
66
import semmle.python.RegexTreeView
77

88
/**
9-
* Holds if `term` is an ecape class representing e.g. `\d`.
9+
* Holds if `term` is an escape class representing e.g. `\d`.
1010
* `clazz` is which character class it represents, e.g. "d" for `\d`.
1111
*/
1212
predicate isEscapeClass(RegExpTerm term, string clazz) {

‎ruby/ql/lib/codeql/ruby/security/regexp/NfaUtils.qll‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -59,8 +59,8 @@ predicate matchesEpsilon(RegExpTerm t) {
5959
/**
6060
* A lookahead/lookbehind that matches the empty string.
6161
*/
62-
class EmptyPositiveSubPatttern extends RegExpSubPattern {
63-
EmptyPositiveSubPatttern() {
62+
class EmptyPositiveSubPattern extends RegExpSubPattern {
63+
EmptyPositiveSubPattern() {
6464
(
6565
this instanceof RegExpPositiveLookahead
6666
or
@@ -70,6 +70,9 @@ class EmptyPositiveSubPatttern extends RegExpSubPattern {
7070
}
7171
}
7272

73+
/** DEPRECATED: Use `EmptyPositiveSubPattern` instead. */
74+
deprecated class EmptyPositiveSubPatttern = EmptyPositiveSubPattern;
75+
7376
/**
7477
* A branch in a disjunction that is the root node in a literal, or a literal
7578
* whose root node is not a disjunction.
@@ -133,7 +136,7 @@ private predicate isCanonicalTerm(RelevantRegExpTerm term, string str) {
133136
}
134137

135138
/**
136-
* Gets a string reperesentation of the flags used with the regular expression.
139+
* Gets a string representation of the flags used with the regular expression.
137140
* Only the flags that are relevant for the canonicalization are included.
138141
*/
139142
string getCanonicalizationFlags(RegExpTerm root) {
@@ -334,7 +337,7 @@ private module CharacterClasses {
334337
)
335338
}
336339

337-
private string lowercaseLetter() { result = "abdcefghijklmnopqrstuvwxyz".charAt(_) }
340+
private string lowercaseLetter() { result = "abcdefghijklmnopqrstuvwxyz".charAt(_) }
338341

339342
private string upperCaseLetter() { result = "ABCDEFGHIJKLMNOPQRSTUVWXYZ".charAt(_) }
340343

@@ -697,9 +700,7 @@ predicate delta(State q1, EdgeLabel lbl, State q2) {
697700
lbl = Epsilon() and q2 = Accept(getRoot(dollar))
698701
)
699702
or
700-
exists(EmptyPositiveSubPatttern empty | q1 = before(empty) |
701-
lbl = Epsilon() and q2 = after(empty)
702-
)
703+
exists(EmptyPositiveSubPattern empty | q1 = before(empty) | lbl = Epsilon() and q2 = after(empty))
703704
}
704705

705706
/**
@@ -1028,7 +1029,7 @@ module ReDoSPruning<isCandidateSig/2 isCandidate> {
10281029
* as the suffix "X" will cause both the regular expressions to be rejected.
10291030
*
10301031
* The string `w` is repeated any number of times because it needs to be
1031-
* infinitely repeatedable for the attack to work.
1032+
* infinitely repeatable for the attack to work.
10321033
* For the regular expression `/((ab)+)*abab/` the accepting state is not reachable from the fork
10331034
* using epsilon transitions. But any attempt at repeating `w` will end in a state that accepts all suffixes.
10341035
*/

‎ruby/ql/lib/codeql/ruby/security/regexp/NfaUtilsSpecific.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ import codeql.Locations
77
private import codeql.ruby.ast.Literal as Ast
88

99
/**
10-
* Holds if `term` is an ecape class representing e.g. `\d`.
10+
* Holds if `term` is an escape class representing e.g. `\d`.
1111
* `clazz` is which character class it represents, e.g. "d" for `\d`.
1212
*/
1313
predicate isEscapeClass(RegExpTerm term, string clazz) {

0 commit comments

Comments
 (0)