2

I have an IRC bot written in python3 that parses user requests for search and replace. Is there any risk of DoS or other attack by doing this?

  • 1
    I'd have to see the way you created your code. If you allow regex to execute bad commands, then yes, it would quite likely be vulnerable. If you use regex to validate data, and then restrict it from using dangerous commands, you should be okay. – Mark Buffalo Jan 29 '16 at 2:33
8

Regex can become an incredibly slow operation in Python 3 because python's re module doesn't build a DFA in the background and instead uses recursive backtracking. This means that the regular expression will take exponential time rather than linear time when applied to a string. An attacker could construct a regular expression that takes the maximum amount of time to complete by abusing recursive backtracking which can result in a DoS attack if the time to process these regexes is much slower than the possible frequency of requests.

To mitigate this problem I suggest using NFA compiling to DFA regex implementation which you may have to create yourself or find as a module somewhere. Did some preliminary searches and didn't find much to report.

  • 4
    Good answer. See also regular expression denial of service attacks (ReDoS) for further information. And if the attacker can control both regex and input this attack gets really effective. – Steffen Ullrich Jan 29 '16 at 3:04
  • @SteffenUllrich I've been trying some of the evil regexs, they all seem fine. It doesn't take any longer for the replacement to run. – Shelvacu Jan 29 '16 at 4:33
  • @SteffenUllrich Nevermind, I got it to fail. – Shelvacu Jan 29 '16 at 4:34
  • A much simpler solution is to have a timeout on the evaluation of any regex. – g.rocket Aug 7 '18 at 21:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.