Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit a09ffd5

Browse files
erik-krogherik-krogh
committed
expand getAOverlapBetweenCharacterClasses to support overlap between more char classes
1 parent 4ede04f commit a09ffd5

4 files changed

Lines changed: 44 additions & 12 deletions

File tree

‎javascript/ql/src/Performance/ReDoS.ql‎

Lines changed: 28 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -469,11 +469,10 @@ predicate charClassMatchesChar(RegExpCharacterClass cc, string char) {
469469
}
470470

471471
/**
472-
* Gets the minimum char that is matched by both the positive char class `c` and the
473-
* negative char class `d`.
472+
* Gets the minimum char that is matched by both the character classes `c` and `d`.
474473
*/
475474
pragma[noinline]
476-
private string getMinOverlapBetweenCharacterClasses(CharClass c, InvertedCharClass d) {
475+
private string getMinOverlapBetweenCharacterClasses(TInputSymbol c, TInputSymbol d) {
477476
result = min(getAOverlapBetweenCharacterClasses(c, d))
478477
}
479478

@@ -506,17 +505,35 @@ private string getARelevantCharClassChar(TInputSymbol symbol) {
506505
}
507506

508507
/**
509-
* Gets a char that is matched by both the positive char class `c` and the
510-
* negative char class `d`.
508+
* Gets a char that is matched by both the character classes `c` and `d`.
511509
*/
512-
private string getAOverlapBetweenCharacterClasses(CharClass c, InvertedCharClass d) {
510+
private string getAOverlapBetweenCharacterClasses(TInputSymbol c, TInputSymbol d) {
513511
sharesRoot(c, d) and
514512
result = [getARelevantCharClassChar(c), getARelevantCharClassChar(d)] and
515-
exists(RegExpCharacterClass negClass, RegExpCharacterClass posClass |
516-
c = CharClass(posClass) and
517-
d = InvertedCharClass(negClass) and
518-
charClassMatchesChar(posClass, result) and
519-
not charClassMatchesChar(negClass, result)
513+
(
514+
// pos-neg
515+
exists(RegExpCharacterClass negClass, RegExpCharacterClass posClass |
516+
c = CharClass(posClass) and
517+
d = InvertedCharClass(negClass) and
518+
charClassMatchesChar(posClass, result) and
519+
not charClassMatchesChar(negClass, result)
520+
)
521+
or
522+
// pos-pos
523+
exists(RegExpCharacterClass class1, RegExpCharacterClass class2 | not class1 = class2 |
524+
c = CharClass(class1) and
525+
d = CharClass(class2) and
526+
charClassMatchesChar(class1, result) and
527+
charClassMatchesChar(class2, result)
528+
)
529+
or
530+
// neg-neg
531+
exists(RegExpCharacterClass class1, RegExpCharacterClass class2 | not class1 = class2 |
532+
c = InvertedCharClass(class1) and
533+
d = InvertedCharClass(class2) and
534+
not charClassMatchesChar(class1, result) and
535+
not charClassMatchesChar(class2, result)
536+
)
520537
)
521538
}
522539

‎javascript/ql/test/query-tests/Performance/ReDoS/ReDoS.expected‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
| polynomial-redos.js:17:5:17:6 | .* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of ','. |
22
| polynomial-redos.js:41:52:41:63 | [\\x21-\\x7E]* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '?'. |
3+
| polynomial-redos.js:46:33:46:45 | [a-zA-Z_0-9]* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'A'. |
34
| regexplib/address.js:51:803:51:811 | [A-Za-z]+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'A'. |
45
| regexplib/address.js:75:803:75:811 | [A-Za-z]+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'A'. |
56
| regexplib/dates.js:66:133:66:139 | JANUARY | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'JANUARY'. |
@@ -17,22 +18,28 @@
1718
| regexplib/dates.js:66:234:66:240 | PRESENT | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'PRESENT'. |
1819
| regexplib/email.js:5:24:5:35 | [a-zA-Z0-9]+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '0'. |
1920
| regexplib/email.js:5:63:5:74 | [a-zA-Z0-9]+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '0'. |
21+
| regexplib/email.js:6:10:6:35 | (?:[a-zA-Z0-9][\\.\\-\\+_]?)* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '0'. |
2022
| regexplib/email.js:25:67:25:78 | [a-zA-Z0-9]+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '0'. |
2123
| regexplib/email.js:25:106:25:117 | [a-zA-Z0-9]+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '0'. |
2224
| regexplib/email.js:25:212:25:223 | [a-zA-Z0-9]+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '0'. |
2325
| regexplib/email.js:25:251:25:262 | [a-zA-Z0-9]+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '0'. |
26+
| regexplib/email.js:33:38:33:51 | ([0-9a-zA-Z])+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '00.'. |
2427
| regexplib/email.js:34:24:34:35 | [a-zA-Z0-9]+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '0'. |
2528
| regexplib/email.js:34:63:34:74 | [a-zA-Z0-9]+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '0'. |
2629
| regexplib/markup.js:13:6:13:12 | [^"']+? | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '('. |
2730
| regexplib/markup.js:13:14:13:16 | .+? | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'a"'. |
2831
| regexplib/markup.js:37:29:37:56 | [a-zA-Z0-9\|:\|\\/\|=\|-\|.\|\\?\|&]* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '='. |
2932
| regexplib/markup.js:53:29:53:56 | [a-zA-Z0-9\|:\|\\/\|=\|-\|.\|\\?\|&]* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '='. |
33+
| regexplib/misc.js:15:56:15:118 | (([^\\\\/:\\*\\?"\\\|<>\\. ])\|([^\\\\/:\\*\\?"\\\|<>]*[^\\\\/:\\*\\?"\\\|<>\\. ]))? | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '!\\\\}'. |
34+
| regexplib/misc.js:24:56:24:118 | (([^\\\\/:\\*\\?"\\\|<>\\. ])\|([^\\\\/:\\*\\?"\\\|<>]*[^\\\\/:\\*\\?"\\\|<>\\. ]))? | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '!\\\\}'. |
3035
| regexplib/misc.js:79:3:79:25 | (\\/w\|\\/W\|[^<>+?$%{}&])+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '/W'. |
3136
| regexplib/misc.js:142:3:142:25 | (\\/w\|\\/W\|[^<>+?$%{}&])+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '/W'. |
3237
| regexplib/strings.js:19:31:19:57 | [a-z&#230;&#248;&#229;0-9]+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '#'. |
3338
| regexplib/uri.js:3:128:3:129 | .* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '/'. |
3439
| regexplib/uri.js:38:35:38:40 | [a-z]+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'a'. |
40+
| regexplib/uri.js:38:52:38:60 | [a-z0-9]+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '0a'. |
3541
| regexplib/uri.js:55:35:55:40 | [a-z]+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'a'. |
42+
| regexplib/uri.js:55:52:55:60 | [a-z0-9]+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '0a'. |
3643
| regexplib/uri.js:63:393:63:429 | [a-zA-Z0-9\\.\\,\\?\\'\\\\/\\+&%\\$#\\=~_\\-@]* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '/#'. |
3744
| tst.js:4:18:4:32 | (?:__\|[\\s\\S])+? | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '__'. |
3845
| tst.js:4:42:4:58 | (?:\\*\\*\|[\\s\\S])+? | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '**'. |
@@ -64,3 +71,5 @@
6471
| tst.js:113:15:113:27 | ([0-9]\|[^a])* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '0'. |
6572
| tst.js:116:60:116:104 | (?:\\\\[\\x00-\\x7f]\|[^\\x00-\\x08\\x0a-\\x1f\\x7f"])* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '\\\\!'. |
6673
| tst.js:119:16:119:60 | (?:\\\\[\\x00-\\x7f]\|[^\\x00-\\x08\\x0a-\\x1f\\x7f"])* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '\\\\!'. |
74+
| tst.js:125:15:125:28 | ([a-z]\|[d-h])* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'd'. |
75+
| tst.js:128:15:128:30 | ([^a-z]\|[^0-9])* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '/'. |

‎javascript/ql/test/query-tests/Performance/ReDoS/polynomial-redos.js‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ app.use(function(req, res) {
4343
tainted.match(/^([a-z0-9-]+)[ \t]+([a-zA-Z0-9+\/]+[=]*)([\n \t]+([^\n]+))?$/); // NOT OK - but not flagged due to lack of support for inverted character classes
4444
tainted.match(/^([a-z0-9-]+)[ \t]+([a-zA-Z0-9+\/]+[=]*)([ \t]+([^ \t][^\n]*[\n]*)?)?$/); // OK
4545

46-
tainted.match(/^(?:\.?[a-zA-Z_][a-zA-Z_0-9]*)+$/); // NOT OK - but not flagged
46+
tainted.match(/^(?:\.?[a-zA-Z_][a-zA-Z_0-9]*)+$/); // NOT OK - but only flagged by js/redos
4747
tainted.match(/^(?:\.?[a-zA-Z_][a-zA-Z_0-9]*)(?:\.[a-zA-Z_][a-zA-Z_0-9]*)*$/); // OK
4848
tainted.replaceAll(/\s*\n\s*/g, ' '); // NOT OK
4949

‎javascript/ql/test/query-tests/Performance/ReDoS/tst.js‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -120,3 +120,9 @@ var bad25 = /"((?:\\[\x00-\x7f]|[^\x00-\x08\x0a-\x1f\x7f"])*)"/;
120120

121121
// GOOD
122122
var bad26 = /"((?:\\[\x00-\x7f]|[^\x00-\x08\x0a-\x1f\x7f"\\])*)"/;
123+
124+
// NOT GOOD
125+
var bad27 = /(([a-z]|[d-h])*)"/;
126+
127+
// NOT GOOD
128+
var bad27 = /(([^a-z]|[^0-9])*)"/;

0 commit comments

Comments
 (0)