vuln-regex-detector
A tool to scan projects for regexes vulnerable to catastrophic backtracking (REDOS) through static extraction, detection, and validation.
What is vuln-regex-detector?
davisjam/vuln-regex-detector is a security tool that scans software projects for regular expressions vulnerable to catastrophic backtracking, which can cause ReDoS (Regular Expression Denial of Service) attacks. It statically extracts regex patterns from source code, analyzes them for potential vulnerabilities using multiple detection algorithms, and validates findings to minimize false positives. The tool helps developers identify and mitigate security risks in their codebases that could lead to denial-of-service vulnerabilities.
This tool is designed for software developers, security engineers, and DevOps teams responsible for maintaining secure codebases, particularly those working with applications that process untrusted input using regular expressions. It is also suitable for open-source maintainers and organizations conducting security audits or compliance checks.
Developers choose this tool over alternatives because it prioritizes precision by including a validation stage that tests evil inputs in the target language, ensuring reported vulnerabilities are genuine and reducing false positives. It also supports multiple programming languages, offers a caching system to avoid redundant analysis, and provides Docker support for easy deployment across different environments.
Overview
Detect vulnerable regexes in your project. REDOS, catastrophic backtracking.
Use Cases
Best For
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.