3 ms·
I'm using a great ReDoS checker. https://github.com/makenowjust-labs/recheck https://github.com/makenowjust-labs/recheck I use the checker to basically fix ev
by falsandtru 4y ago
I'm using a great ReDoS checker.
https://github.com/makenowjust-labs/recheck https://github.com/makenowjust-labs/recheck
I use the checker to basically fix even regular expressions that are not actually vulnerable. This checker can be used as a lint, so there is no excuse to allow regular lint but not regular expression lint. ReDoS hunt is very enjoyable. Enjoy!
- falsandtru 4y agoPlayground is ready. Try it! https://makenowjust-labs.github.io/recheck/playground/ https://makenowjust-labs.github.io/recheck/playground/
- syrrim 4y agoyou could use a regex library not vulnerable to quadratic behaviour in the first place?
- woodruffw 4y agoThis is not actionable general-purpose advice: many languages have regular expression APIs built around PCRE, which is much more of a "general advanced pattern matching" language than just pure regular expressions. Many of PCRE's features (like backreferences) are widely used and allow for parsing of non-regular inputs, meaning that you can't transform them into a linearly-evaluable regular expression.