diff --git a/java/ql/src/Security/CWE/CWE-730/PolynomialReDoS.qhelp b/java/ql/src/Security/CWE/CWE-730/PolynomialReDoS.qhelp index e0b8ea6108f..5a56343420a 100644 --- a/java/ql/src/Security/CWE/CWE-730/PolynomialReDoS.qhelp +++ b/java/ql/src/Security/CWE/CWE-730/PolynomialReDoS.qhelp @@ -105,7 +105,7 @@ Pattern.compile("^\\s+|\\s+$").matcher(text).replaceAll("") // BAD

Sometimes it is unclear how a regular expression can be rewritten to avoid the problem. In such cases, it often suffices to limit the - length of the input string. For instance, the following complicated + length of the input string. For instance, the following regular expression is used to match numbers, and on some non-number inputs it can have quadratic time complexity:

@@ -115,7 +115,7 @@ Pattern.matches("^(\\+|-)?(\\d+|(\\d*\\.\\d*))?(E|e)?([-+])?(\\d+)?$", str); It is not immediately obvious how to rewrite this regular expression - to avoid the problem. However, it might be fine to limit the length + to avoid the problem. However, you can mitigate performance issues by limiting the length to 1000 characters, which will always finish in a reasonable amount of time.

diff --git a/javascript/ql/src/Performance/PolynomialReDoS.qhelp b/javascript/ql/src/Performance/PolynomialReDoS.qhelp index b8c82c90ecb..2a96c60edd8 100644 --- a/javascript/ql/src/Performance/PolynomialReDoS.qhelp +++ b/javascript/ql/src/Performance/PolynomialReDoS.qhelp @@ -105,7 +105,7 @@ text.replace(/^\s+|\s+$/g, ''); // BAD

Sometimes it is unclear how a regular expression can be rewritten to avoid the problem. In such cases, it often suffices to limit the - length of the input string. For instance, the following complicated + length of the input string. For instance, the following regular expression is used to match numbers, and on some non-number inputs it can have quadratic time complexity:

@@ -115,7 +115,7 @@ text.replace(/^\s+|\s+$/g, ''); // BAD

It is not immediately obvious how to rewrite this regular expression - to avoid the problem. However, it might be fine to limit the length + to avoid the problem. However, you can mitigate performance issues by limiting the length to 1000 characters, which will always finish in a reasonable amount of time.

@@ -124,6 +124,7 @@ text.replace(/^\s+|\s+$/g, ''); // BAD if (str.length > 1000) { throw new Error("Input too long"); } + /^(\+|-)?(\d+|(\d*\.\d*))?(E|e)?([-+])?(\d+)?$/.test(str) diff --git a/python/ql/src/Security/CWE-730/PolynomialReDoS.qhelp b/python/ql/src/Security/CWE-730/PolynomialReDoS.qhelp index 13ae7a1f3d3..9157fc442eb 100644 --- a/python/ql/src/Security/CWE-730/PolynomialReDoS.qhelp +++ b/python/ql/src/Security/CWE-730/PolynomialReDoS.qhelp @@ -105,7 +105,7 @@ re.sub(r"^\s+|\s+$", "", text) # BAD

Sometimes it is unclear how a regular expression can be rewritten to avoid the problem. In such cases, it often suffices to limit the - length of the input string. For instance, the following complicated + length of the input string. For instance, the following regular expression is used to match numbers, and on some non-number inputs it can have quadratic time complexity:

@@ -115,7 +115,7 @@ match = re.search(r'^(\+|-)?(\d+|(\d*\.\d*))?(E|e)?([-+])?(\d+)?$', str) It is not immediately obvious how to rewrite this regular expression - to avoid the problem. However, it might be fine to limit the length + to avoid the problem. However, you can mitigate performance issues by limiting the length to 1000 characters, which will always finish in a reasonable amount of time.

diff --git a/ruby/ql/src/queries/security/cwe-1333/PolynomialReDoS.qhelp b/ruby/ql/src/queries/security/cwe-1333/PolynomialReDoS.qhelp index 86f96445a2a..f66fd40b792 100644 --- a/ruby/ql/src/queries/security/cwe-1333/PolynomialReDoS.qhelp +++ b/ruby/ql/src/queries/security/cwe-1333/PolynomialReDoS.qhelp @@ -110,7 +110,7 @@ text.gsub!(/^\s+|\s+$/, '') # BAD

Sometimes it is unclear how a regular expression can be rewritten to avoid the problem. In such cases, it often suffices to limit the - length of the input string. For instance, the following complicated + length of the input string. For instance, the following regular expression is used to match numbers, and on some non-number inputs it can have quadratic time complexity:

@@ -120,7 +120,7 @@ is_matching = /^(\+|-)?(\d+|(\d*\.\d*))?(E|e)?([-+])?(\d+)?$/.match?(str) It is not immediately obvious how to rewrite this regular expression - to avoid the problem. However, it might be fine to limit the length + to avoid the problem. However, you can mitigate performance issues by limiting the length to 1000 characters, which will always finish in a reasonable amount of time.