OWASP defines "evil regex" (here) as follows:

Evil Regexes A Regex is called "evil" if it can stuck on crafted input. Evil Regex pattern contains: Grouping with repetition Inside the repeated group: Repetition Alternation with overlapping

Examples of Evil Patterns:

    (.*a){x} | for x > 10

From the perspective of development and pentesting, I'd like to know if this is a complete characterization of "evil regex", or whether other forms exist?

Also, is there are any algorithm or method for constructing an input for a vulnerable regex that may cause it to "hang" arbitrarily long?

  • 1
    If the regex is not written correctly you can create issues for sure, for example a regex expression like "abcdefg" will create 7 linear operations on the analyzed data that could potentially boost the cpu. Regex expressions needs to be evaluated and study the impact in order to avoid performance issues or invalid matches. – camp0 Sep 2 '19 at 8:34
  • Thanks, what's wrong with the regex "abcdefg"? It takes a constant amount of time to evaluate at each position in the input string. – Shuzheng Sep 2 '19 at 8:46
  • Pathological cases differ from regex engine to regex engine, so a good list would be by implementation. – Bruno Rohée Sep 2 '19 at 9:12
  • Sorry the edit didn't reflect the regex that I want to put, here is the regex with the issue "a.*b.*c.*d.*e.*f", so if you have 1MB of data with out that characters you will scan 7 times the MB, bear in mind that this is an example to illustrate a performance issue. – camp0 Sep 2 '19 at 9:26
  • 1
    @camp0, if neither of those characters are present int the MB, then the scanning will proceed over the input in one pass, with no match for "a" at any position. – Shuzheng Sep 2 '19 at 10:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.