Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 51fb3da

Browse files
asgerfasgerf
committed
JS: Accept ReDoS alerts in regexplib
1 parent d298d87 commit 51fb3da

7 files changed

Lines changed: 42 additions & 42 deletions

File tree

‎javascript/ql/test/query-tests/Security/CWE-400/ReDoS/regexplib/address.js‎

Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎javascript/ql/test/query-tests/Security/CWE-400/ReDoS/regexplib/dates.js‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎javascript/ql/test/query-tests/Security/CWE-400/ReDoS/regexplib/email.js‎

Lines changed: 8 additions & 8 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎javascript/ql/test/query-tests/Security/CWE-400/ReDoS/regexplib/markup.js‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,27 @@
11
/<[^>]*\n?.*=("|')?(.*\.jpg)("|')?.*\n?[^<]*>/g;
22
/<[^>]*>/g;
3-
/(<\/?)(?i:(?<element>a(bbr|cronym|ddress|pplet|rea)?|b(ase(font)?|do|ig|lockquote|ody|r|utton)?|c(aption|enter|ite|(o(de|l(group)?)))|d(d|el|fn|i(r|v)|l|t)|em|f(ieldset|o(nt|rm)|rame(set)?)|h([1-6]|ead|r|tml)|i(frame|mg|n(put|s)|sindex)?|kbd|l(abel|egend|i(nk)?)|m(ap|e(nu|ta))|no(frames|script)|o(bject|l|pt(group|ion))|p(aram|re)?|q|s(amp|cript|elect|mall|pan|t(r(ike|ong)|yle)|u(b|p))|t(able|body|d|extarea|foot|h|itle|r|t)|u(l)?|var))(\s(?<attr>.+?))*>/g;
3+
/(<\/?)(?i:(?<element>a(bbr|cronym|ddress|pplet|rea)?|b(ase(font)?|do|ig|lockquote|ody|r|utton)?|c(aption|enter|ite|(o(de|l(group)?)))|d(d|el|fn|i(r|v)|l|t)|em|f(ieldset|o(nt|rm)|rame(set)?)|h([1-6]|ead|r|tml)|i(frame|mg|n(put|s)|sindex)?|kbd|l(abel|egend|i(nk)?)|m(ap|e(nu|ta))|no(frames|script)|o(bject|l|pt(group|ion))|p(aram|re)?|q|s(amp|cript|elect|mall|pan|t(r(ike|ong)|yle)|u(b|p))|t(able|body|d|extarea|foot|h|itle|r|t)|u(l)?|var))(\s(?<attr>.+?))*>/g; // $ Alert[js/redos]
44
/\xA9/g;
55
/(?'DateLiteral' (?# Per the VB Spec : DateLiteral ::= '#' [ Whitespace+ ] DateOrTime [ Whitespace+ ] '#' ) \#\s* (?'DateOrTime' (?# DateOrTime ::= DateValue Whitespace+ TimeValue | DateValue | TimeValue ) (?'DateValue' (?# DateValue ::= Whitespace+ TimeValue | DateValue | TimeValue ) ( (?# DateValue ::= MonthValue \/ DayValue \/ YearValue | MonthValue - DayValue - YearValue ) (?'Month'(0?[1-9])|1[0-2]) (?# Month 01 - 12 ) (?'Sep'[-/]) (?# Date separator '-' or '\/' ) (?'Day'0?[1-9]|[12]\d|3[01]) (?# Day 01 - 31 ) \k'Sep' (?# whatever date separator was previously matched ) (?'Year'\d{1,4}) \s+ (?# TimeValue ::= HourValue : MinuteValue [ : SecondValue ] [ WhiteSpace+ ] [ AMPM ] ) (?'HourValue'(0?[1-9])|1[0-9]|2[0-4]) (?# Hour 01 - 24 ) [:] (?'MinuteValue'0?[1-9]|[1-5]\d|60) (?# Minute 01 - 60 ) [:] (?'SecondValue':0?[1-9]|[1-5]\d|60)? (?# Optional Minute :01 - :60 ) \s* (?'AMPM'[AP]M)? ) | ( (?# DateValue ::= MonthValue \/ DayValue \/ YearValue | MonthValue - DayValue - YearValue ) (?'Month'(0?[1-9])|1[0-2]) (?# Month 01 - 12 ) (?'Sep'[-/]) (?# Date separator '-' or '\/' ) (?'Day'0?[1-9]|[12]\d|3[01]) (?# Month 01 - 31 ) \k'Sep' (?# whatever date separator was previously matched ) (?'Year'\d{4}) ) | ( (?# TimeValue ::= HourValue : MinuteValue [ : SecondValue ] [ WhiteSpace+ ] [ AMPM ] ) (?'HourValue'(0?[1-9])|1[0-9]|2[0-4]) (?# Hour 01 - 24 ) [:] (?'MinuteValue'0?[1-9]|[1-5]\d|60) (?# Minute 01 - 60 ) [:] (?'SecondValue':0?[1-9]|[1-5]\d|60)? (?# Optional Minute :01 - :60 ) \s* (?'AMPM'[AP]M)? ) ) ) \s*\# )/g;
66
/(SELECT\s[\w\*\)\(\,\s]+\sFROM\s[\w]+)| (UPDATE\s[\w]+\sSET\s[\w\,\'\=]+)| (INSERT\sINTO\s[\d\w]+[\s\w\d\)\(\,]*\sVALUES\s\([\d\w\'\,\)]+)| (DELETE\sFROM\s[\d\w\'\=]+)/g;
7-
/"([^"](?:\\.|[^\\"]*)*)"/g;
7+
/"([^"](?:\\.|[^\\"]*)*)"/g; // $ Alert[js/redos]
88
/href=[\"\'](http:\/\/|\.\/|\/)?\w+(\.\w+)*(\/\w+(\.\w+)?)*(\/|\?\w*=\w*(&\w*=\w*)*)?[\"\']/g;
99
/<!--[\s\S]*?--[ \t\n\r]*>/g;
1010
/href[ ]*=[ ]*('|\")([^\"'])*('|\")/g;
1111
/<!--.*?-->/g;
1212
/(?s)( class=\w+(?=([^<]*>)))|(<!--\[if.*?<!\[endif\]-->)|(<!\[if !\w+\]>)|(<!\[endif\]>)|(<o:p>[^<]*<\/o:p>)|(<span[^>]*>)|(<\/span>)|(font-family:[^>]*[;'])|(font-size:[^>]*[;'])(?-s)/g;
13-
/<(?:[^"']+?|.+?(?:"|').*?(?:"|')?.*?)*?>/g;
13+
/<(?:[^"']+?|.+?(?:"|').*?(?:"|')?.*?)*?>/g; // $ Alert[js/redos]
1414
/<(?<tag>.*).*>(?<text>.*)<\/\k<tag>>/g;
1515
/<(\/{0,1})img(.*?)(\/{0,1})\>/g;
1616
/src[^>]*[^/].(?:jpg|bmp|gif)(?:\"|\')/g;
17-
/<(\w+)(\s(\w*=".*?")?)*((\/>)|((\/*?)>.*?<\/\1>))/g;
17+
/<(\w+)(\s(\w*=".*?")?)*((\/>)|((\/*?)>.*?<\/\1>))/g; // $ Alert[js/redos]
1818
/(?i:on(blur|c(hange|lick)|dblclick|focus|keypress|(key|mouse)(down|up)|(un)?load|mouse(move|o(ut|ver))|reset|s(elect|ubmit)))/g;
1919
/(<meta\s+)*((name\s*=\s*("|')(?<name>[^'("|')]*)("|')){1}|content\s*=\s*("|')(?<content>[^'("|')]*)("|')|scheme\s*=\s*("|')(?<scheme>[^'("|')]*)("|'))/g;
2020
/<\*?font # Match start of Font Tag (?(?=[^>]+color.*>) #IF\/THEN lookahead color in tag (.*?color\s*?[=|:]\s*?) # IF found THEN move ahead ('+\#*?[\w\s]*'+ # CAPTURE ColorName\/Hex |"+\#*?[\w\s]*"+ # single or double |\#*\w*\b) # or no quotes .*?> # & move to end of tag |.*?> # ELSE move to end of Tag ) # Close the If\/Then lookahead # Use Multiline and IgnoreCase # Replace the matches from RE with MatchEvaluator below: # if m.Groups(1).Value<>"" then # Return "<font color=" & m.Groups(1).Value & ">" # else # Return "<font>" # end if/g;
2121
/(?'openingTag'<) \s*? (?'tagName'\w+) # Once we've got the tagname, match zero # or more attribute sequences (\s*? # Atomic Grouping for efficiency (?> (?!=[\/\?]?>) # Lookahead so that we can fail quickly # match Attribute pieces (?'attribName'\w+) (?:\s* (?'attribSign'=) \s* ) (?'attribValue' (?:\'[^\']*\'|\"[^\"]*\"|[^ >]+) ) ) )* \s*? # Closing Tag can be either > or \/> (?'closeTag'[\/\?]?>)/g;
2222
/^#?(([fFcC0369])\2){3}$/g;
2323
/&(?![a-zA-Z]{2,6};|#[0-9]{3};)/g;
24-
/&lt;\/?([a-zA-Z][-A-Za-z\d\.]{0,71})(\s+(\S+)(\s*=\s*([-\w\.]{1,1024}|&quot;[^&quot;]{0,1024}&quot;|'[^']{0,1024}'))?)*\s*&gt;/g;
24+
/&lt;\/?([a-zA-Z][-A-Za-z\d\.]{0,71})(\s+(\S+)(\s*=\s*([-\w\.]{1,1024}|&quot;[^&quot;]{0,1024}&quot;|'[^']{0,1024}'))?)*\s*&gt;/g; // $ Alert[js/redos]
2525
/<[a-zA-Z][^>]*\son\w+=(\w+|'[^']*'|"[^"]*")[^>]*>/g;
2626
/>(?:(?<t>[^<]*))/g;
2727
/<[^>]*name[\s]*=[\s]*"?[^\w_]*"?[^>]*>/g;
@@ -34,26 +34,26 @@
3434
/<([^\s>]*)(\s[^<]*)>/g;
3535
/^[a-zA-Z_]{1}[a-zA-Z0-9_]+$/g;
3636
/[0][x][0-9a-fA-F]+/g;
37-
/(\[(\w+)\s*(([\w]*)=('|")?([a-zA-Z0-9|:|\/|=|-|.|\?|&]*)(\5)?)*\])([a-zA-Z0-9|:|\/|=|-|.|\?|&|\s]+)(\[\/\2\])/g;
37+
/(\[(\w+)\s*(([\w]*)=('|")?([a-zA-Z0-9|:|\/|=|-|.|\?|&]*)(\5)?)*\])([a-zA-Z0-9|:|\/|=|-|.|\?|&|\s]+)(\[\/\2\])/g; // $ Alert[js/redos]
3838
/%[\-\+0\s\#]{0,1}(\d+){0,1}(\.\d+){0,1}[hlI]{0,1}[cCdiouxXeEfgGnpsS]{1}/g;
3939
/^(Function|Sub)(\s+[\w]+)\([^\(\)]*\)/g;
40-
/^(?<path>(\/?(?<step>\w+))+)(?<predicate>\[(?<comparison>\s*(?<lhs>@\w+)\s*(?<operator><=|>=|<>|=|<|>)\s*(?<rhs>('[^']*'|"[^"]*"))\s*(and|or)?)+\])*$/g;
40+
/^(?<path>(\/?(?<step>\w+))+)(?<predicate>\[(?<comparison>\s*(?<lhs>@\w+)\s*(?<operator><=|>=|<>|=|<|>)\s*(?<rhs>('[^']*'|"[^"]*"))\s*(and|or)?)+\])*$/g; // $ Alert[js/redos]
4141
/^(?<Code>([^"']|"[^"]*")*)'(?<Comment>.*)$/g;
4242
/>(?:(?<t>[^<]*))/g;
4343
/<[a-zA-Z][^>]*\son\w+=(\w+|'[^']*'|"[^"]*")[^>]*>/g;
4444
/<[^>]*name[\s]*=[\s]*"?[^\w_]*"?[^>]*>/g;
4545
/\/\*[\d\D]*?\*\//g;
4646
/^#?([a-f]|[A-F]|[0-9]){3}(([a-f]|[A-F]|[0-9]){3})?$/g;
47-
/&lt;\/?([a-zA-Z][-A-Za-z\d\.]{0,71})(\s+(\S+)(\s*=\s*([-\w\.]{1,1024}|&quot;[^&quot;]{0,1024}&quot;|'[^']{0,1024}'))?)*\s*&gt;/g;
47+
/&lt;\/?([a-zA-Z][-A-Za-z\d\.]{0,71})(\s+(\S+)(\s*=\s*([-\w\.]{1,1024}|&quot;[^&quot;]{0,1024}&quot;|'[^']{0,1024}'))?)*\s*&gt;/g; // $ Alert[js/redos]
4848
/<!--[\s\S]*?-->/g;
4949
/("[^"]*")|('[^\r]*)(\r\n)?/g;
5050
/(?'openingTag'<) \s*? (?'tagName'\w+) # Once we've got the tagname, match zero # or more attribute sequences (\s*? # Atomic Grouping for efficiency (?> (?!=[\/\?]?>) # Lookahead so that we can fail quickly # match Attribute pieces (?'attribName'\w+) (?:\s* (?'attribSign'=) \s* ) (?'attribValue' (?:\'[^\']*\'|\"[^\"]*\"|[^ >]+) ) ) )* \s*? # Closing Tag can be either > or \/> (?'closeTag'[\/\?]?>)/g;
5151
/&(?![a-zA-Z]{2,6};|#[0-9]{3};)/g;
5252
/^#?(([fFcC0369])\2){3}$/g;
53-
/(\[(\w+)\s*(([\w]*)=('|")?([a-zA-Z0-9|:|\/|=|-|.|\?|&]*)(\5)?)*\])([a-zA-Z0-9|:|\/|=|-|.|\?|&|\s]+)(\[\/\2\])/g;
53+
/(\[(\w+)\s*(([\w]*)=('|")?([a-zA-Z0-9|:|\/|=|-|.|\?|&]*)(\5)?)*\])([a-zA-Z0-9|:|\/|=|-|.|\?|&|\s]+)(\[\/\2\])/g; // $ Alert[js/redos]
5454
/[0][x][0-9a-fA-F]+/g;
5555
/%[\-\+0\s\#]{0,1}(\d+){0,1}(\.\d+){0,1}[hlI]{0,1}[cCdiouxXeEfgGnpsS]{1}/g;
56-
/^(?<path>(\/?(?<step>\w+))+)(?<predicate>\[(?<comparison>\s*(?<lhs>@\w+)\s*(?<operator><=|>=|<>|=|<|>)\s*(?<rhs>('[^']*'|"[^"]*"))\s*(and|or)?)+\])*$/g;
56+
/^(?<path>(\/?(?<step>\w+))+)(?<predicate>\[(?<comparison>\s*(?<lhs>@\w+)\s*(?<operator><=|>=|<>|=|<|>)\s*(?<rhs>('[^']*'|"[^"]*"))\s*(and|or)?)+\])*$/g; // $ Alert[js/redos]
5757
/^(Function|Sub)(\s+[\w]+)\([^\(\)]*\)/g;
5858
/^[a-zA-Z_]{1}[a-zA-Z0-9_]+$/g;
5959
/^[^<>`~!/@\#}$%:;)(_^{&*=|'+]+$/g;

0 commit comments

Comments
 (0)