hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-18 01:33:15 +01:00
Code Issues Packages Projects Releases Wiki Activity

Python: Prevent explosion in poly-ReDoS query

Browse Source 
I consider this to be a short-term solution to the performance problems
we identified. The choice of "at most ten occurrences of `.*`" is
somewhat arbitrary, and it's possible a higher limit would work just as
well.
This commit is contained in:
Taus
2021-08-18 13:18:56 +00:00
committed by GitHub
parent 92804a3cc3
commit af91a2df00
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
python/ql/src/semmle/python/security/performance/RegExpTreeView.qll
View File

@@ -11,5 +11,8 @@ import semmle.python.RegexTreeView
* For javascript we make the pragmatic performance optimization to ignore files we did not extract.
*/
predicate isExcluded(RegExpParent parent) {
not exists(parent.getRegex().getLocation().getFile().getRelativePath())
not exists(parent.getRegex().getLocation().getFile().getRelativePath()) or
// Regexes with many occurrences of ".*" may cause the polynomial ReDoS computation to explode, so
// we explicitly exclude these.
count(int i | exists(parent.getRegex().getText().regexpFind("\\.\\*", i, _)) | i) > 10
}