I have an IRC bot written in python3 that parses user requests for search and replace. Is there any risk of DoS or other attack by doing this?
2
-
1I'd have to see the way you created your code. If you allow regex to execute bad commands, then yes, it would quite likely be vulnerable. If you use regex to validate data, and then restrict it from using dangerous commands, you should be okay.– Mark BuffaloCommented Jan 29, 2016 at 2:33
-
regular-expressions.mobi/catastrophic.html– SobriqueCommented Jan 29, 2016 at 7:32
Add a comment
|
1 Answer
Regex can become an incredibly slow operation in Python 3 because python's re module doesn't build a DFA in the background and instead uses recursive backtracking. This means that the regular expression will take exponential time rather than linear time when applied to a string. An attacker could construct a regular expression that takes the maximum amount of time to complete by abusing recursive backtracking which can result in a DoS attack if the time to process these regexes is much slower than the possible frequency of requests.
To mitigate this problem I suggest using NFA compiling to DFA regex implementation which you may have to create yourself or find as a module somewhere. Did some preliminary searches and didn't find much to report.
-
4Good answer. See also regular expression denial of service attacks (ReDoS) for further information. And if the attacker can control both regex and input this attack gets really effective. Commented Jan 29, 2016 at 3:04
-
@SteffenUllrich I've been trying some of the evil regexs, they all seem fine. It doesn't take any longer for the replacement to run.– ShelvacuCommented Jan 29, 2016 at 4:33
-
-
A much simpler solution is to have a timeout on the evaluation of any regex. Commented Aug 7, 2018 at 21:21