hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-23 04:06:37 +01:00
Code Issues Packages Projects Releases Wiki Activity

finding the minimum that is not an FP - instead of finding the minimum and then checking if it was an FP. And detecting more FPs by finding when a witness pass through the accept state

Browse Source
This commit is contained in:
Erik Krogh Kristensen
2020-11-04 21:04:08 +01:00
parent ac514b1739
commit 34fd0d89f5
3 changed files with 25 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
javascript/ql/src/Performance/ReDoS.ql
View File

@@ -840,7 +840,6 @@ predicate isPumpable(State fork, string w) {
*/
State process(State fork, string w, int i) {
isPumpable(fork, w) and
min(string s | isPumpable(fork, s)).prefix(w.length()) = w and
exists(State prev |
i = 0 and prev = fork
or
@@ -876,9 +875,12 @@ string rotate(string str, int i) {
from RegExpTerm t, string c, int i
where
c = min(string w | isPumpable(Match(t, i), w)) and
not isPumpable(epsilonSucc+(Match(t, i)), _) and
not epsilonSucc*(process(Match(t, i), c, [0 .. c.length() - 1])) = Accept(_)
c =
min(string w |
isPumpable(Match(t, i), w) and
not isPumpable(epsilonSucc+(Match(t, i)), _) and
not epsilonSucc*(process(Match(t, i), w, [0 .. w.length() - 1])) = Accept(_)
)
select t,
"This part of the regular expression may cause exponential backtracking on strings " +
"containing many repetitions of '" + escape(rotate(c, i)) + "'."