hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-25 08:45:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Allow quantifiers invoving {}; add comments

Browse Source
This commit is contained in:
Joe Farebrother
2022-03-29 11:07:24 +01:00
parent bc17d4b91f
commit e5ca924240
2 changed files with 13 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
java/ql/lib/semmle/code/java/regex/RegexFlowConfigs.qll
View File

@@ -10,7 +10,7 @@ private import RegexFlowModels
private import semmle.code.java.security.SecurityTests
private class ExploitableStringLiteral extends StringLiteral {
ExploitableStringLiteral() { this.getValue().matches(["%+%", "%*%"]) }
ExploitableStringLiteral() { this.getValue().matches(["%+%", "%*%", "%{%}%"]) }
}
private class RegexCompileFlowConf extends DataFlow2::Configuration {
@@ -32,6 +32,9 @@ private class RegexCompileFlowConf extends DataFlow2::Configuration {
/**
* Holds if `s` is used as a regex, with the mode `mode` (if known).
* If regex mode is not known, `mode` will be `"None"`.
*
* As an optimisation, only regexes containing an infinite repitition quatifier (`+`, `*`, or `{x,}`)
* and therefore may be relevant for ReDoS queries are considered.
*/
predicate usedAsRegex(StringLiteral s, string mode, boolean match_full_string) {
exists(DataFlow::Node sink |
@@ -224,6 +227,9 @@ private class RegexMatchFlowConf extends DataFlow2::Configuration {
/**
* Holds if the string literal `regex` is a regular expression that is matched against the expression `str`.
*
* As an optimisation, only regexes containing an infinite repitition quatifier (`+`, `*`, or `{x,}`)
* and therefore may be relevant for ReDoS queries are considered.
*/
predicate regexMatchedAgainst(StringLiteral regex, Expr str) {
exists(

7
java/ql/lib/semmle/code/java/regex/RegexTreeView.qll
View File

@@ -71,7 +71,12 @@ class RegExpParent extends TRegExpParent {
abstract Regex getRegex();
}
/** A string literal used as a regular expression */
/**
* A string literal used as a regular expression.
*
* As an optimisation, only regexes containing an infinite repitition quatifier (`+`, `*`, or `{x,}`)
* and therefore may be relevant for ReDoS queries are considered.
*/
class RegExpLiteral extends TRegExpLiteral, RegExpParent {
Regex re;