Presented at All Things Open 2023 Presented by Phil Nash - Sonar Title: Total ReDoS: The dangers of regex in JavaScript Abstract: Regular expressions are complicated and can be hard to learn. On top of that, they can also be a security risk; writing the wrong pattern can open your application up to denial of service attacks. One token out of place and you invite in the dreaded ReDoS. But how can a regular expression cause this? In this talk we’ll track down the patterns that can cause this trouble, explain why they are an issue and propose ways to fix them now and avoid them in the future. Together we’ll demystify these powerful search patterns and keep your application safe from expressions that behave in a way that is anything but regular. Find more info about All Things Open: On the web: https://www.allthingsopen.org/ Twitter: https://twitter.com/AllThingsOpen LinkedIn: https://www.linkedin.com/company/all-things-open/ Instagram: https://www.instagram.com/allthingsopen/ Facebook: https://www.facebook.com/AllThingsOpen Mastodon: https://mastodon.social/@allthingsopen Threads: https://www.threads.net/@allthingsopen 2023 conference: https://2023.allthingsopen.org/

1. Total ReDoS: The dangers
of regex in JavaScript
Phil Nash
Developer Advocate for Sonar

2. @philnash

3. Phil Nash
twitter.com/philnash
@philnash@mastodon.social
linkedin.com/in/philnash
https://philna.sh
@philnash

4. Motivation: ReDoS
@philnash

5. Jamie Zawinski
Some people, when confronted with a
problem, think "I know, I'll use regular
expressions."
Now they have two problems.
@philnash

6. @philnash

7. @philnash

8. Backtracking and
Catastrophic Backtracking
@philnash

9. /^[su200c]+|[su200c]+$/
/s*,s*/
/^(.+.)*localhost$/
/("[^"]*"|[^@])*@[^@]*/
/(?:(?:"|'|]|}||d|(?:nan|infinity|true|false|null|undefined|symbol|math)|`|-
|+)+[)]*;?((?:s|-|~|!|{}||||+)*.*(?:.*=.*)))/
@philnash

10. Backtrack
Overflow
@philnash

11. Backtrack Overflow
/ /
^[su200c]+|[su200c]+$
@philnash

12. Backtrack Overflow
/a+$/
@philnash

13. Backtrack Overflow
/a+$/.test("aaaaab")
(aaaaa)b
a(aaaa)b
aa(aaa)b
aaa(aa)b
aaaa(a)b
/a+$/.test("aaaaab") // => false
@philnash

14. Backtrack Overflow
"aaaaab" => 22 steps
"aaaaaab" => 29 steps
"aaaaaaab" => 37 steps
20,000 characters => 200,000,000 steps
@philnash

15. 34 minute outage
@philnash

16. http-cache-semantics
const parts = header.trim().split(/s*,s*/);
for (const part of parts) {
const [k, v] = part.split(/s*=s*/, 2);
cc[k] = v === undefined ? true : v.replace(/^"|"$/g, '');
}
@philnash

17. How to fix it
@philnash

18. Limit the regular expression
/s*,s*/
/s{0,64},s{0,64}/
...or limit the size of the string
@philnash

19. Avoid regular expressions
string.trim();
@philnash

20. http-cache-semantics
const parts = header.trim().split(/,/);
for (const part of parts) {
const [k, v] = part.split(/=/, 2);
cc[k.trim()] = v === undefined ? true : v.trim().replace(/^"|"$/g, '')
}
@philnash

21. Catastrophic
Backtracking
@philnash

22. node-fetch
@philnash

23. node-fetch
/ /
^(.+.)*localhost$
@philnash

24. node-fetch
/^(.+.)*localhost$/.test("a.a.a.a.a.a.a")
(a.a.a.a.a.a.)a
(a.a.a.a.a.)(a.)a
(a.a.a.a.)(a.a.)a
(a.a.a.a.)(a.)(a.)a
(a.a.a.)(a.a.a.)a
(a.a.a.)(a.a.)(a.)a
(a.a.a.)(a.)(a.a.)a
(a.a.a.)(a.)(a.)(a.)a
@philnash

25. CloudFlareUp
/(?:(?:"|'|]|}||d|(?:nan|infinity|true|false|null|undefined|symbol
@philnash

26. CloudFlareUp
“"”
“'”
“]”
“}”
“”
digit
“nan”
“infinity”
“true”
“false”
“null”
“undefined”
“symbol”
“math”
“`”
“-”
“+”
One of:
“)” “;”
group #1
white space
“-”
“~”
“!”
“{}”
“||”
“+”
any character any character “=” any character
@philnash

27. CloudFlareUp
/".*.*=.*/
@philnash

28. 27 minutes of
downtime
@philnash

29. Superhuman and Zod
beaten by emails
@philnash

30. Superhuman
/ @[^@]*/
("[^"]*"|[^@])*
@philnash

31. Zod
/^ [A-Z0-9_+-]@.../i
([A-Z0-9_+-]+ )*
.?
([A-Z0-9_+-]+)*
@philnash

32. How to fix it
@philnash

33. Refactor nested qualifiers
Avoid overlaps!
Overlapping disjunctions: (a|ab)+
Consecutive patterns: .*.*
Hidden consecutive patterns: .*=?.*
@philnash

34. Refactor overlaps
node-fetch
=>
(.+.) ([^.]+.)
@philnash

35. Refactor overlaps
Superhuman
/("[^"]*"| )*@([^@]*)/
=> /("[^"]*"| )*@([^@]*)/
[^@]
[^@"]
@philnash

36. Atomic groups
Are not a feature in JavaScript.
@philnash

37. Fake atomic groups
/^(.+.)*localhost$/
/^ localhost$/
(?= )
((.+.)*) 1
https://blog.stevenlevithan.com/archives/mimic-atomic-groups
@philnash

38. Avoid regular expressions
node-fetch replaced
with
if (/^(.+.)*localhost$/.test(url.host)) {
if (url.host === 'localhost' || url.host.endsWith('.localhost')) {
@philnash

39. Use a different engine
RE2: https://github.com/google/re2/
@philnash

40. Discovering ReDoS issues
@philnash

41. Tools
/
SonarQube SonarCloud
regex.rip
recheck
eslint-plugin-redos
eslint-plugin-regexp
@philnash

42. Thank you
twitter.com/philnash
@philnash@mastodon.social
linkedin.com/in/philnash
https://philna.sh