hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-23 12:16:33 +01:00
Code Issues Packages Projects Releases Wiki Activity

Swift: The perf. issue is fixed by above commit "Do regex locations more like Ruby does them."

Browse Source
This commit is contained in:
Geoffrey White
2023-06-21 18:45:38 +01:00
parent 925477ed66
commit d3af8c5123
3 changed files with 957 additions and 852 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
swift/ql/lib/codeql/swift/regex/RegexTreeView.qll
View File

@@ -1188,9 +1188,7 @@ private module Impl implements RegexTreeViewSig {
/**
* Holds if the regular expression should not be considered.
*/
predicate isExcluded(RegExpParent parent) {
none()
}
predicate isExcluded(RegExpParent parent) { none() }
/**
* Holds if `term` is a possessive quantifier.

1792
swift/ql/test/library-tests/regex/parse.expected
View File

File diff suppressed because it is too large Load Diff

13
swift/ql/test/library-tests/regex/redos_variants.swift
View File

@@ -379,13 +379,12 @@ func myRegexpVariantsTests(myUrl: URL) throws {
_ = try Regex(#"([^\\\]]+)*"#).firstMatch(in: tainted)
// BAD
// TODO: QL evaluation times out (for test, at 5 minutes)
// times out:
// _ = try Regex(#"(\w*foobarbaz\w*foobarbaz\w*foobarbaz\w*foobarbaz\s*foobarbaz\d*foobarbaz\w*)+-"#).firstMatch(in: tainted) // $ redos-vulnerable=
// a simpler regex that times out:
// _ = try Regex(#"(\w*foobarfoobarfoobarfoobarfoobarfoobarfoobarfoobar)+"#).firstMatch(in: tainted) // $ redos-vulnerable=
// a simpler regerx that doesn't time out but is slow to evaluate:
// _ = try Regex(#"(\w*foobarfoobarfoobar)+"#).firstMatch(in: tainted) // $ redos-vulnerable=
_ = try Regex(#"(\w*foobarbaz\w*foobarbaz\w*foobarbaz\w*foobarbaz\s*foobarbaz\d*foobarbaz\w*)+-"#).firstMatch(in: tainted) // $ redos-vulnerable=
// GOOD
// (these regexs explore a query performance issue we had at one point)
_ = try Regex(#"(\w*foobarfoobarfoobarfoobarfoobarfoobarfoobarfoobar)+"#).firstMatch(in: tainted)
_ = try Regex(#"(\w*foobarfoobarfoobar)+"#).firstMatch(in: tainted)
// BAD (but cannot currently construct a prefix)
// attack string: "aa" + "b" x lots + "!"