hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-04 13:15:21 +02:00
Code Issues Packages Projects Releases Wiki Activity

Ruby: parse \G, \b, and \B anchors as special characters, not escapes

Browse Source
This commit is contained in:
Nick Rolfe
2021-11-12 12:16:28 +00:00
parent 1f3f7e9ccc
commit f63c768d9f
6 changed files with 133 additions and 94 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
ruby/ql/test/query-tests/security/cwe-1333-exponential-redos/ReDoS.expected
View File

@@ -91,3 +91,5 @@
| tst.rb:362:11:362:31 | ((?:a{0,\|-)\|\\w\\{\\d,)+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'a{0,'. |
| tst.rb:363:11:363:34 | ((?:a{0,2\|-)\|\\w\\{\\d,\\d)+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'a{0,2'. |
| tst.rb:369:12:369:22 | (\\u0061\|a)* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'a'. |
| tst.rb:375:12:375:18 | (a\|\\w)* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'a'. |
| tst.rb:376:12:376:18 | (a\|\\w)* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'a'. |

7
ruby/ql/test/query-tests/security/cwe-1333-exponential-redos/tst.rb
View File

@@ -369,4 +369,9 @@ good42 = /^((?:a{0,2}|-)|\w\{\d,\d\})+X$/
bad87 = /^X(\u0061|a)*Y$/
# GOOD
good43 = /^X(\u0061|b)+Y$/
good43 = /^X(\u0061|b)+Y$/
# NOT GOOD
bad88 = /\G(a|\w)*$/
bad89 = /\b(a|\w)*$/