diff --git a/java/ql/src/Security/CWE/CWE-730/PolynomialReDoS.qhelp b/java/ql/src/Security/CWE/CWE-730/PolynomialReDoS.qhelp index fa8a3563d23..dbb1f4c37f5 100644 --- a/java/ql/src/Security/CWE/CWE-730/PolynomialReDoS.qhelp +++ b/java/ql/src/Security/CWE/CWE-730/PolynomialReDoS.qhelp @@ -14,13 +14,13 @@
-
- The sub-expression "\s+$" will match the
+ The sub-expression "\\s+$" will match the
whitespace characters in text from left to right, but it
can start matching anywhere within a whitespace sequence. This is
problematic for strings that do not end with a whitespace
@@ -45,14 +45,14 @@
Avoid this problem by rewriting the regular expression to
not contain the ambiguity about when to start matching whitespace
sequences. For instance, by using a negative look-behind
- (^\s+|(?<!\s)\s+$), or just by using the built-in strip
- method (text.strip()).
+ ("^\\s+|(?<!\\s)\\s+$"), or just by using the built-in trim
+ method (text.trim()).
- Note that the sub-expression "^\s+" is
+ Note that the sub-expression "^\\s+" is
not problematic as the ^ anchor restricts
when that sub-expression can start matching, and as the regular
expression engine matches from left to right.
@@ -70,8 +70,8 @@
using scientific notation:
@@ -97,7 +97,7 @@
To make the processing faster, the regular expression
should be rewritten such that the two \d+ sub-expressions
- do not have overlapping matches: ^0\.\d+(E\d+)?$.
+ do not have overlapping matches: "^0\\.\\d+(E\\d+)?$".
Consider this regular expression:
-@@ -24,7 +24,7 @@ This problem can be avoided by rewriting the regular expression to remove the ambiguity between the two branches of the alternative inside the repetition:
-- The regular expression engine provided by Python uses a backtracking non-deterministic finite + The regular expression engine provided by Java uses a backtracking non-deterministic finite automata to implement regular expression matching. While this approach is space-efficient and allows supporting advanced features like capture groups, it is not time-efficient in general. The worst-case @@ -38,6 +38,11 @@ references.
+ ++ Note that Java versions 9 and above have some mitigations against ReDoS; however they aren't perfect + and more complex regular expressions can still be affected by this problem. +