hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-01 03:35:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

detect more expensive regexps in js/polynomial-redos

Browse Source
This commit is contained in:
Erik Krogh Kristensen
2020-10-25 23:31:36 +01:00
parent 5ac8475523
commit ebc4856456
4 changed files with 181 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
javascript/ql/src/semmle/javascript/security/performance/SuperlinearBackTracking.qll
View File

@@ -124,10 +124,20 @@ class PolynomialBackTrackingTerm extends InfiniteRepetitionQuantifier {
forall(RegExpTerm pred | pred = this.getPredecessor+() | matchesEpsilon(pred)) and
reason = "it can start matching anywhere"
or
exists(InfiniteRepetitionQuantifier pred |
pred = getAMatchPredecessor(this.getPredecessor()) and
compatible(pred.getAChild(), this.getAChild())
exists(RegExpTerm pred |
pred instanceof InfiniteRepetitionQuantifier
or
forall(RegExpTerm predpred | predpred = pred.getPredecessor+() | matchesEpsilon(predpred))
|
pred = getAMatchPredecessor(this.getPredecessor()) and
(
// compatible children
compatible(pred.getAChild(), this.getAChild())
or
// or `this` is compatible with everything (and the predecessor is something)
unique( | | this.getAChild()) instanceof RegExpDot and
exists([pred, pred.getAChild()].getAMatchedString())
) and
reason =
"it can start matching anywhere after the start of the preceeding '" + pred.toString() +
"'"