diff --git a/java/ql/lib/semmle/code/java/regex/RegexTreeView.qll b/java/ql/lib/semmle/code/java/regex/RegexTreeView.qll index de2ab7ca181..14663327103 100644 --- a/java/ql/lib/semmle/code/java/regex/RegexTreeView.qll +++ b/java/ql/lib/semmle/code/java/regex/RegexTreeView.qll @@ -468,7 +468,9 @@ class RegExpEscape extends RegExpNormalChar { * TODO: Handle named escapes. */ override string getValue() { - this.isIdentityEscape() and result = this.getUnescaped() + not this.isUnicode() and + this.isIdentityEscape() and + result = this.getUnescaped() or this.getUnescaped() = "n" and result = "\n" or diff --git a/python/ql/lib/semmle/python/RegexTreeView.qll b/python/ql/lib/semmle/python/RegexTreeView.qll index 80a5e6a4be4..808a784d472 100644 --- a/python/ql/lib/semmle/python/RegexTreeView.qll +++ b/python/ql/lib/semmle/python/RegexTreeView.qll @@ -466,7 +466,9 @@ class RegExpEscape extends RegExpNormalChar { * TODO: Handle named escapes. */ override string getValue() { - this.isIdentityEscape() and result = this.getUnescaped() + not this.isUnicode() and + this.isIdentityEscape() and + result = this.getUnescaped() or this.getUnescaped() = "n" and result = "\n" or diff --git a/python/ql/test/query-tests/Security/CWE-730-ReDoS/redos.py b/python/ql/test/query-tests/Security/CWE-730-ReDoS/redos.py index 3357e567044..a49bd8b3e4b 100644 --- a/python/ql/test/query-tests/Security/CWE-730-ReDoS/redos.py +++ b/python/ql/test/query-tests/Security/CWE-730-ReDoS/redos.py @@ -383,4 +383,7 @@ bad89 = re.compile(r'/("[^"]*?"|[^"\s]+)+(?=X)') # BAD bad90 = re.compile(r'\A(\d|0)*x') bad91 = re.compile(r'(\d|0)*\Z') -bad92 = re.compile(r'\b(\d|0)*x') \ No newline at end of file +bad92 = re.compile(r'\b(\d|0)*x') + +# GOOD +stress1 = re.compile(r"(?