1

OWASP defines "evil regex" (here) as follows:

Evil Regexes A Regex is called "evil" if it can stuck on crafted input. Evil Regex pattern contains: Grouping with repetition Inside the repeated group: Repetition Alternation with overlapping

Examples of Evil Patterns:

    (a+)+
    ([a-zA-Z]+)*
    (a|aa)+
    (a|a?)+
    (.*a){x} | for x > 10

From the perspective of development and pentesting, I'd like to know if this is a complete characterization of "evil regex", or whether other forms exist?

Also, is there are any algorithm or method for constructing an input for a vulnerable regex that may cause it to "hang" arbitrarily long?

Improve this question
7
  • 1
    If the regex is not written correctly you can create issues for sure, for example a regex expression like "abcdefg" will create 7 linear operations on the analyzed data that could potentially boost the cpu. Regex expressions needs to be evaluated and study the impact in order to avoid performance issues or invalid matches.
    – camp0
    Sep 2, 2019 at 8:34
  • Thanks, what's wrong with the regex "abcdefg"? It takes a constant amount of time to evaluate at each position in the input string.
    – Shuzheng
    Sep 2, 2019 at 8:46
  • Pathological cases differ from regex engine to regex engine, so a good list would be by implementation.
    – Bruno Rohée
    Sep 2, 2019 at 9:12
  • Sorry the edit didn't reflect the regex that I want to put, here is the regex with the issue "a.*b.*c.*d.*e.*f", so if you have 1MB of data with out that characters you will scan 7 times the MB, bear in mind that this is an example to illustrate a performance issue.
    – camp0
    Sep 2, 2019 at 9:26
  • 1
    @camp0, if neither of those characters are present int the MB, then the scanning will proceed over the input in one pass, with no match for "a" at any position.
    – Shuzheng
    Sep 2, 2019 at 10:56

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .