Detects ReDoS patterns through static analysis and timed execution. Identifies nested quantifiers, ambiguous alternation, and exponential complexity triggers.
Static analysis + timing test across multiple input lengths to detect superlinear growth.
Tests regular expressions for ReDoS (Regular Expression Denial of Service) vulnerability by analyzing the pattern for catastrophic backtracking characteristics. Also lets you test a regex against sample input strings to validate behavior.
ReDoS occurs when a regular expression with nested quantifiers or alternation can be forced into exponential backtracking with a specifically crafted input string, causing the processing thread to consume excessive CPU and creating a denial of service condition.
Regular expression vulnerabilities are a real application security issue that appears in server-side validation code, web application firewalls, and security tools. A carefully crafted user input that triggers catastrophic backtracking can make a single request consume 100% CPU for seconds or longer.
This is particularly relevant for input validation regex patterns — email validation, URL validation, and IP address validation regexes are frequent sources of ReDoS vulnerabilities. The fix is typically to rewrite the pattern to avoid nested quantifiers.