Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 16473fc

Browse files
erik-krogherik-krogh
committed
matching a inverted char class with a char
1 parent 804aaf3 commit 16473fc

3 files changed

Lines changed: 32 additions & 10 deletions

File tree

‎javascript/ql/src/Performance/ReDoS.ql‎

Lines changed: 18 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -429,6 +429,20 @@ newtype Trace =
429429
t = Nil() and isFork(_, s1, s2, _, _)
430430
}
431431

432+
/**
433+
* Holds if the character class `cc` has a child (constant or range) that matches `char`.
434+
*/
435+
bindingset[char]
436+
predicate charClassMatchesChar(RegExpCharacterClass cc, string char) {
437+
exists(RegExpTerm child | child = cc.getAChild() |
438+
char = child.(RegExpConstant).getValue()
439+
or
440+
exists(string lo, string hi | child.(RegExpCharacterRange).isRange(lo, hi) |
441+
lo <= char and char <= hi
442+
)
443+
)
444+
}
445+
432446
/**
433447
* Gets a character that is represented by both `c` and `d`.
434448
*/
@@ -437,14 +451,10 @@ string intersect(InputSymbol c, InputSymbol d) {
437451
(
438452
d = Char(result)
439453
or
440-
exists(RegExpCharacterClass cc | d = CharClass(cc) |
441-
exists(RegExpTerm child | child = cc.getAChild() |
442-
result = child.(RegExpConstant).getValue()
443-
or
444-
exists(string lo, string hi | child.(RegExpCharacterRange).isRange(lo, hi) |
445-
lo <= result and result <= hi
446-
)
447-
)
454+
exists(RegExpCharacterClass cc | d = CharClass(cc) | charClassMatchesChar(cc, result))
455+
or
456+
exists(RegExpCharacterClass cc | d = InvertedCharClass(cc) |
457+
not charClassMatchesChar(cc, result)
448458
)
449459
or
450460
d = Dot() and

‎javascript/ql/test/query-tests/Performance/ReDoS/ReDoS.expected‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,8 @@
2727
| regexplib/markup.js:13:14:13:16 | .+? | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'a"'. |
2828
| regexplib/markup.js:37:29:37:56 | [a-zA-Z0-9\|:\|\\/\|=\|-\|.\|\\?\|&]* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '='. |
2929
| regexplib/markup.js:53:29:53:56 | [a-zA-Z0-9\|:\|\\/\|=\|-\|.\|\\?\|&]* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '='. |
30+
| regexplib/misc.js:79:3:79:25 | (\\/w\|\\/W\|[^<>+?$%{}&])+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '/W'. |
31+
| regexplib/misc.js:142:3:142:25 | (\\/w\|\\/W\|[^<>+?$%{}&])+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '/W'. |
3032
| regexplib/strings.js:19:31:19:57 | [a-z&#230;&#248;&#229;0-9]+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '#'. |
3133
| regexplib/uri.js:3:128:3:129 | .* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '/'. |
3234
| regexplib/uri.js:38:35:38:40 | [a-z]+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'a'. |
@@ -54,5 +56,6 @@
5456
| tst.js:83:14:83:20 | (.\|\\n)* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '\\n'. |
5557
| tst.js:89:25:89:32 | (a\|aa?)* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'a'. |
5658
| tst.js:95:15:95:25 | ([^]\|[^a])* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'b'. |
57-
| tst.js:98:15:98:20 | [^"']+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '('. |
5859
| tst.js:101:15:101:23 | (.\|[^a])* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'b'. |
60+
| tst.js:107:15:107:23 | (b\|[^a])* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'b'. |
61+
| tst.js:110:15:110:23 | (G\|[^a])* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'G'. |

‎javascript/ql/test/query-tests/Performance/ReDoS/tst.js‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -94,8 +94,17 @@ var good9 = '(a|aa?)*b';
9494
// NOT GOOD
9595
var bad18 = /(([^]|[^a])*)"/;
9696

97-
// NOT GOOD
97+
// NOT GOOD - but not flagged
9898
var bad19 = /([^"']+)*/g;
9999

100100
// NOT GOOD
101101
var bad20 = /((.|[^a])*)"/;
102+
103+
// GOOD
104+
var good10 = /((a|[^a])*)"/;
105+
106+
// NOT GOOD
107+
var bad21 = /((b|[^a])*)"/;
108+
109+
// NOT GOOD
110+
var bad22 = /((G|[^a])*)"/;

0 commit comments

Comments
 (0)