2 ms·
I agree. The complication is that it's not just "per project" but "can an attacker exploit it in a way that matters?". If so-called ReDoS can only be triggered
by dwheeler 4y ago
I agree. The complication is that it's not just "per project" but "can an attacker exploit it in a way that matters?". If so-called ReDoS can only be triggered by trusted data, it's not a vulnerability.
- xnorswap 4y agoIf something relies on trusted data I'd argue there isn't a ReDoS vulnerability there at all. In some ways this reminds of XML/JSON parsing vulnerabilities. If ran on untrusted / unsanitised data they can be absolutely tier 1 critical (remote code execution) but if parsing trusted data then they are essentially benign. If someone claims you have a vulnerability and you disagree then it's on the submitter to prove it with a PoC or a plausible mechanism for triggering it. That doesn't however invalidate the whole class of vulnerabilities.