A tool to scan projects for regexes vulnerable to catastrophic backtracking (REDOS) through static extraction, detection, and validation.
davisjam/vuln-regex-detector is a security tool that scans software projects for regular expressions vulnerable to catastrophic backtracking, which can cause ReDoS (Regular Expression Denial of Service) attacks. It statically extracts regex patterns from source code, analyzes them for potential vulnerabilities using multiple detection algorithms, and validates findings to minimize false positives. The tool helps developers identify and mitigate security risks in their codebases that could lead to denial-of-service vulnerabilities.
This tool is designed for software developers, security engineers, and DevOps teams responsible for maintaining secure codebases, particularly those working with applications that process untrusted input using regular expressions. It is also suitable for open-source maintainers and organizations conducting security audits or compliance checks.
Developers choose this tool over alternatives because it prioritizes precision by including a validation stage that tests evil inputs in the target language, ensuring reported vulnerabilities are genuine and reducing false positives. It also supports multiple programming languages, offers a caching system to avoid redundant analysis, and provides Docker support for easy deployment across different environments.
Detect vulnerable regexes in your project. REDOS, catastrophic backtracking.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Includes a validation stage that tests evil inputs in the target language, ensuring reported vulnerabilities are genuine and minimizing false positives, as highlighted in the 'Caveats' and philosophy.
Statically extracts regexes from multiple programming languages and validates them language-specifically, making it versatile for diverse projects, as detailed in the extraction and validation READMEs.
Offers optional server caching to avoid redundant expensive regex analysis, saving time and resources for repeated scans, mentioned in the vulnerability detection stage and caching feature.
Provides Docker support for easier execution on non-Ubuntu systems, ensuring consistent deployment across environments, as described in the Docker section.
Misses dynamically defined regexes (e.g., from variables), limiting coverage for codebases with runtime regex construction, as admitted in the 'Caveats'.
Vulnerability detection relies on imperfect detectors that may have bugs or timeouts, leading to potential false negatives and incomplete risk assessment, as noted in the 'Caveats'.
Direct configuration is Ubuntu-only; other systems require Docker, adding overhead and complexity for setup and maintenance, as indicated in the supported OSes section.
Reports vulnerable regexes regardless of whether they are exploitable in context (e.g., in test code or with trusted input), which can generate unnecessary noise in reports.