codeql/cpp/ql/lib/change-notes/2026-07-17-cpp-regex-bre-grammar.md

category

category
minorAnalysis

• The C++ regular-expression parser (semmle.code.cpp.regex.internal.ParseRegExp) now models POSIX Basic Regular Expressions (BRE) via a new concrete BreRegExp subclass. BRE is selected by the std::regex_constants::basic and grep flags. Where BRE inverts the metacharacter/escape convention relative to POSIX ERE and ECMAScript — backslash-prefixed \(...\) are capturing groups (bare (...) are literals), \{n,m\} is the interval quantifier (bare braces are literal text), and +, ?, | are literal characters — the parser follows the POSIX specification. Positional rules for * (literal at the start of a subexpression), ^ (anchor only at start of subexpression) and $ (anchor only at end of subexpression) are implemented; \1..\9 numbered back-references are supported. The GNU-BRE extensions \+, \?, \| are not modeled — they are treated as escaped literals. Along with ECMAScript (EcmaRegExp) and POSIX ERE (EreRegExp), all six of the std::regex_constants grammar flags now have a concrete parser subclass and every regex is analyzed.
• The C++ ReDoS queries (cpp/redos and cpp/polynomial-redos) now analyze regexes constructed with the std::regex_constants::basic grammar flag; grep remains excluded via isBacktrackingEngine (POSIX tool-style engines are treated as linear-time), mirroring the existing extended-vs-egrep/awk split for ERE.