From 7675571daae0cbe934b70d480dd605d278f6618f Mon Sep 17 00:00:00 2001 From: erik-krogh Date: Tue, 27 Sep 2022 13:25:23 +0200 Subject: [PATCH] fix RegExpEscape::getValue having multiple results for some escapes --- java/ql/lib/semmle/code/java/regex/RegexTreeView.qll | 4 +++- python/ql/lib/semmle/python/RegexTreeView.qll | 4 +++- python/ql/test/query-tests/Security/CWE-730-ReDoS/redos.py | 5 ++++- ruby/ql/lib/codeql/ruby/regexp/RegExpTreeView.qll | 4 +++- 4 files changed, 13 insertions(+), 4 deletions(-) diff --git a/java/ql/lib/semmle/code/java/regex/RegexTreeView.qll b/java/ql/lib/semmle/code/java/regex/RegexTreeView.qll index de2ab7ca181..14663327103 100644 --- a/java/ql/lib/semmle/code/java/regex/RegexTreeView.qll +++ b/java/ql/lib/semmle/code/java/regex/RegexTreeView.qll @@ -468,7 +468,9 @@ class RegExpEscape extends RegExpNormalChar { * TODO: Handle named escapes. */ override string getValue() { - this.isIdentityEscape() and result = this.getUnescaped() + not this.isUnicode() and + this.isIdentityEscape() and + result = this.getUnescaped() or this.getUnescaped() = "n" and result = "\n" or diff --git a/python/ql/lib/semmle/python/RegexTreeView.qll b/python/ql/lib/semmle/python/RegexTreeView.qll index 80a5e6a4be4..808a784d472 100644 --- a/python/ql/lib/semmle/python/RegexTreeView.qll +++ b/python/ql/lib/semmle/python/RegexTreeView.qll @@ -466,7 +466,9 @@ class RegExpEscape extends RegExpNormalChar { * TODO: Handle named escapes. */ override string getValue() { - this.isIdentityEscape() and result = this.getUnescaped() + not this.isUnicode() and + this.isIdentityEscape() and + result = this.getUnescaped() or this.getUnescaped() = "n" and result = "\n" or diff --git a/python/ql/test/query-tests/Security/CWE-730-ReDoS/redos.py b/python/ql/test/query-tests/Security/CWE-730-ReDoS/redos.py index 3357e567044..a49bd8b3e4b 100644 --- a/python/ql/test/query-tests/Security/CWE-730-ReDoS/redos.py +++ b/python/ql/test/query-tests/Security/CWE-730-ReDoS/redos.py @@ -383,4 +383,7 @@ bad89 = re.compile(r'/("[^"]*?"|[^"\s]+)+(?=X)') # BAD bad90 = re.compile(r'\A(\d|0)*x') bad91 = re.compile(r'(\d|0)*\Z') -bad92 = re.compile(r'\b(\d|0)*x') \ No newline at end of file +bad92 = re.compile(r'\b(\d|0)*x') + +# GOOD +stress1 = re.compile(r"(?