Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit a5e75f5

Browse files
erik-krogherik-krogh
committed
add support for escape char classes inside char classes
1 parent 0063cb1 commit a5e75f5

3 files changed

Lines changed: 42 additions & 23 deletions

File tree

‎javascript/ql/src/Performance/ReDoS.ql‎

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -234,7 +234,14 @@ private module CharacterClasses {
234234
exists(string lo, string hi | child.(RegExpCharacterRange).isRange(lo, hi) |
235235
lo <= char and char <= hi
236236
)
237-
// TODO: RegExpCharacterClassEscape.
237+
or
238+
exists(RegExpCharacterClassEscape escape | escape = child |
239+
escape.getValue() = escape.getValue().toLowerCase() and
240+
classEscapeMatches(escape.getValue(), char)
241+
or
242+
escape.getValue() = escape.getValue().toUpperCase() and
243+
not classEscapeMatches(escape.getValue().toLowerCase(), char)
244+
)
238245
)
239246
}
240247

@@ -248,6 +255,12 @@ private module CharacterClasses {
248255
child.(RegExpCharacterRange).isRange(result, _)
249256
or
250257
child.(RegExpCharacterRange).isRange(_, result)
258+
or
259+
exists(RegExpCharacterClassEscape escape | child = escape |
260+
result = min(string s | classEscapeMatches(escape.getValue().toLowerCase(), s))
261+
or
262+
result = max(string s | classEscapeMatches(escape.getValue().toLowerCase(), s))
263+
)
251264
)
252265
}
253266

@@ -264,15 +277,7 @@ private module CharacterClasses {
264277
bindingset[char]
265278
override predicate matches(string char) { hasChildThatMatches(cc, char) }
266279

267-
override string choose() {
268-
result =
269-
min(string c |
270-
exists(RegExpTerm child | child = cc.getAChild() |
271-
c = child.(RegExpConstant).getValue() or
272-
child.(RegExpCharacterRange).isRange(c, _)
273-
)
274-
)
275-
}
280+
override string choose() { result = min(string c | c = getAMentionedChar(cc)) }
276281
}
277282

278283
/**
@@ -293,19 +298,14 @@ private module CharacterClasses {
293298

294299
override string choose() {
295300
// The next char after the max of the inverted charclass.
296-
result =
297-
nextChar(max(string c |
298-
exists(RegExpTerm child | child = cc.getAChild() |
299-
c = child.(RegExpConstant).getValue() or
300-
child.(RegExpCharacterRange).isRange(_, c)
301-
)
302-
))
301+
result = nextChar(max(string c | c = getAMentionedChar(cc)))
303302
}
304303
}
305304

306305
/**
307306
* Holds if the character class escape `clazz` (\d, \s, or \w) matches `char`.
308307
*/
308+
pragma[noinline]
309309
private predicate classEscapeMatches(string clazz, string char) {
310310
clazz = "d" and
311311
char = "0123456789".charAt(_)

‎javascript/ql/test/query-tests/Performance/ReDoS/ReDoS.expected‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
| regexplib/dates.js:66:201:66:208 | NOVEMBER | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'NOVEMBER'. |
2121
| regexplib/dates.js:66:210:66:217 | DECEMBER | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'DECEMBER'. |
2222
| regexplib/dates.js:66:234:66:240 | PRESENT | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'PRESENT'. |
23+
| regexplib/email.js:1:16:1:22 | [-.\\w]* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '0'. |
2324
| regexplib/email.js:5:24:5:35 | [a-zA-Z0-9]+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '0'. |
2425
| regexplib/email.js:5:63:5:74 | [a-zA-Z0-9]+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '0'. |
2526
| regexplib/email.js:6:10:6:35 | (?:[a-zA-Z0-9][\\.\\-\\+_]?)* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '0'. |
@@ -29,16 +30,18 @@
2930
| regexplib/email.js:25:212:25:223 | [a-zA-Z0-9]+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '0'. |
3031
| regexplib/email.js:25:251:25:262 | [a-zA-Z0-9]+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '0'. |
3132
| regexplib/email.js:32:10:32:25 | (?:\\w[\\.\\-\\+]?)* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '0'. |
33+
| regexplib/email.js:33:16:33:22 | [-.\\w]* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '0'. |
3234
| regexplib/email.js:33:38:33:51 | ([0-9a-zA-Z])+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '00.'. |
35+
| regexplib/email.js:33:53:33:58 | [-\\w]* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '0'. |
3336
| regexplib/email.js:34:24:34:35 | [a-zA-Z0-9]+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '0'. |
3437
| regexplib/email.js:34:63:34:74 | [a-zA-Z0-9]+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '0'. |
3538
| regexplib/markup.js:3:451:3:453 | .+? | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'a '. |
3639
| regexplib/markup.js:13:6:13:12 | [^"']+? | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '('. |
3740
| regexplib/markup.js:13:14:13:16 | .+? | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'a"'. |
38-
| regexplib/markup.js:37:29:37:56 | [a-zA-Z0-9\|:\|\\/\|=\|-\|.\|\\?\|&]* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '='. |
41+
| regexplib/markup.js:37:29:37:56 | [a-zA-Z0-9\|:\|\\/\|=\|-\|.\|\\?\|&]* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '00='. |
3942
| regexplib/markup.js:40:23:40:25 | \\w+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '0'. |
4043
| regexplib/markup.js:40:132:40:134 | \\s* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of ' @0<""'. |
41-
| regexplib/markup.js:53:29:53:56 | [a-zA-Z0-9\|:\|\\/\|=\|-\|.\|\\?\|&]* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '='. |
44+
| regexplib/markup.js:53:29:53:56 | [a-zA-Z0-9\|:\|\\/\|=\|-\|.\|\\?\|&]* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '00='. |
4245
| regexplib/markup.js:56:23:56:25 | \\w+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '0'. |
4346
| regexplib/markup.js:56:132:56:134 | \\s* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of ' @0<""'. |
4447
| regexplib/misc.js:15:56:15:118 | (([^\\\\/:\\*\\?"\\\|<>\\. ])\|([^\\\\/:\\*\\?"\\\|<>]*[^\\\\/:\\*\\?"\\\|<>\\. ]))? | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '!\\\\}'. |
@@ -68,14 +71,14 @@
6871
| tst.js:19:71:19:90 | (?:[^)\\\\]\|\\\\\\\\\|\\\\.)+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '\\\\\\\\'. |
6972
| tst.js:31:54:31:55 | .* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '\|a\|\\n'. |
7073
| tst.js:36:23:36:32 | (\\\\\\/\|.)*? | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '\\\\/'. |
71-
| tst.js:41:27:41:28 | .* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '#'. |
74+
| tst.js:41:27:41:28 | .* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '\t#'. |
7275
| tst.js:47:25:47:27 | .*? | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '""'. |
7376
| tst.js:47:31:47:33 | .*? | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of ''''. |
7477
| tst.js:52:37:52:39 | .*? | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of ']['. |
7578
| tst.js:52:70:52:72 | .*? | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of ']['. |
7679
| tst.js:58:15:58:20 | [a-z]+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'a'. |
7780
| tst.js:60:43:60:54 | [a-zA-Z0-9]+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '0'. |
78-
| tst.js:66:16:66:31 | [\\w#:.~>+()\\s-]+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '#'. |
81+
| tst.js:66:16:66:31 | [\\w#:.~>+()\\s-]+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '\t'. |
7982
| tst.js:66:38:66:40 | .*? | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of ']['. |
8083
| tst.js:71:19:71:26 | (\\\\?.)*? | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '\\\\a'. |
8184
| tst.js:74:14:74:21 | (b\|a?b)* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'b'. |
@@ -100,5 +103,9 @@
100103
| tst.js:149:15:149:24 | (\\s\|[\\f])* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '\u000c'. |
101104
| tst.js:152:15:152:28 | (\\s\|[\\v]\|\\\\v)* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '\u000b'. |
102105
| tst.js:155:15:155:24 | (\\f\|[\\f])* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '\u000c'. |
103-
| tst.js:158:15:158:22 | (\\W\|\\D)* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '!'. |
106+
| tst.js:158:15:158:22 | (\\W\|\\D)* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of ' '. |
104107
| tst.js:161:15:161:22 | (\\S\|\\w)* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '0'. |
108+
| tst.js:164:15:164:24 | (\\S\|[\\w])* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '0'. |
109+
| tst.js:167:15:167:27 | (1s\|[\\da-z])* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '1s'. |
110+
| tst.js:170:15:170:23 | (0\|[\\d])* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '0'. |
111+
| tst.js:173:16:173:20 | [\\d]+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '0'. |

‎javascript/ql/test/query-tests/Performance/ReDoS/tst.js‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -158,4 +158,16 @@ var bad35 = /((\f|[\f])*)"/;
158158
var bad36 = /((\W|\D)*)"/;
159159

160160
// NOT GOOD
161-
var bad37 = /((\S|\w)*)"/;
161+
var bad37 = /((\S|\w)*)"/;
162+
163+
// NOT GOOD
164+
var bad38 = /((\S|[\w])*)"/;
165+
166+
// NOT GOOD
167+
var bad39 = /((1s|[\da-z])*)"/;
168+
169+
// NOT GOOD
170+
var bad40 = /((0|[\d])*)"/;
171+
172+
// NOT GOOD
173+
var bad41 = /(([\d]+)*)"/;

0 commit comments

Comments
 (0)