From c501fa52890f514a542a0093065aaa0345947d09 Mon Sep 17 00:00:00 2001 From: Geoffrey White <40627776+geoffw0@users.noreply.github.com> Date: Tue, 20 Jun 2023 15:27:51 +0100 Subject: [PATCH] Swift: Add more test cases exploring the timeout. --- swift/ql/test/library-tests/regex/redos_variants.swift | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/swift/ql/test/library-tests/regex/redos_variants.swift b/swift/ql/test/library-tests/regex/redos_variants.swift index d1ddc1a198c..4c2b16626a7 100644 --- a/swift/ql/test/library-tests/regex/redos_variants.swift +++ b/swift/ql/test/library-tests/regex/redos_variants.swift @@ -380,7 +380,12 @@ func myRegexpVariantsTests(myUrl: URL) throws { // BAD // TODO: QL evaluation times out (for test, at 5 minutes) + // times out: // _ = try Regex(#"(\w*foobarbaz\w*foobarbaz\w*foobarbaz\w*foobarbaz\s*foobarbaz\d*foobarbaz\w*)+-"#).firstMatch(in: tainted) // $ redos-vulnerable= + // a simpler regex that times out: +// _ = try Regex(#"(\w*foobarfoobarfoobarfoobarfoobarfoobarfoobarfoobar)+"#).firstMatch(in: tainted) // $ redos-vulnerable= + // a simpler regerx that doesn't time out but is slow to evaluate: +// _ = try Regex(#"(\w*foobarfoobarfoobar)+"#).firstMatch(in: tainted) // $ redos-vulnerable= // BAD (but cannot currently construct a prefix) // attack string: "aa" + "b" x lots + "!"