You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+34-42Lines changed: 34 additions & 42 deletions
Original file line number
Diff line number
Diff line change
@@ -1,23 +1,21 @@
1
1
# Regexploit
2
2
3
-
Regular Expression Denial of Service (ReDoS).
3
+
Find regexes which are vulnerable to Regular Expression Denial of Service (ReDoS).
4
4
5
-
Most default regular expression parsers (non-deterministic finite automata) have unbounded worst-case complexity. Regex matching may be quick when presented with a matching input string. However, certain non-matching input strings can make the regular expression matcher go into crazy loops and take ages to process. This can cause denial of service, as the CPU will be stuck trying to match the regex.
5
+
Many default regular expression parsers have unbounded worst-case complexity. Regex matching may be quick when presented with a matching input string. However, certain non-matching input strings can make the regular expression matcher go into crazy backtracking loops and take ages to process. This can cause denial of service, as the CPU will be stuck trying to match the regex.
6
6
7
7
This tool is designed to:
8
8
* find regular expressions which are vulnerable to ReDoS
9
9
* give an example malicious string which will cause catastrophic backtracking
10
10
11
-
Something something regexes are bad.
12
-
13
11
## Worst-case complexity
14
12
15
13
This reflects the complexity of the regular expression matcher's backtracking procedure with respect to the length of the entered string.
16
14
17
15
Cubic complexity here means that if the vulnerable part of the string is doubled in length, the execution time should be about 8 times longer (2^3).
18
16
For exponential ReDoS with starred stars e.g. `(a*)*$` a fudge factor is used and the complexity will be greater than 10.
19
17
20
-
For explotability, a cubic complexity or higher is typically required unless truly giant strings are allowed as input.
18
+
For explotability, cubic complexity or higher is typically required unless truly giant strings are allowed as input.
21
19
22
20
## Example
23
21
@@ -41,7 +39,7 @@ To scan the installed python modules run `regexploit-python-env`.
41
39
42
40
```
43
41
Importing ua_parser.user_agent_parser
44
-
Vulnerable regex in /Users/b3n/Research/redosauto/.env/lib/python3.9/site-packages/ua_parser/user_agent_parser.py #183
42
+
Vulnerable regex in /somewhere/.env/lib/python3.9/site-packages/ua_parser/user_agent_parser.py #183
Search for regexes in all the python modules currently installed in your path / env. This means you can `pip install` whatever modules you are interested in and they will be analysed. Cpython code is included.
102
-
103
-
```bash
104
-
regexploit-python-env
105
-
```
106
-
107
-
N.B. this doesn't parse the python code to an AST and will only find regexes compiled automatically on module import. Modules are actually imported, so code in the modules will be executed.
108
-
109
-
110
98
## Python code
111
99
112
-
Parses Python code (without executing it) via the AST to find regexes (with some false positives). The regexes are then analysed for ReDoS.
100
+
Parses Python code (without executing it) via the AST to find regexes. The regexes are then analysed for ReDoS.
113
101
114
102
```bash
115
-
regexploit-py my-project/stuff.py
103
+
regexploit-py my-project/
116
104
regexploit-py "my-project/**/*.py" --glob
117
105
```
118
-
119
106
## Javascript / Typescript
120
107
121
-
This will use the bundled NodeJS package in `regexploit/bin/javascript` which parses your javascript as an AST with [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/master/packages/parser) and prints out all regexes.
108
+
This will use the bundled NodeJS package in `regexploit/bin/javascript` which parses your javascript as an AST with [eslint](https://github.com/typescript-eslint/typescript-eslint/tree/master/packages/parser) and prints out all regexes.
122
109
123
110
Those regexes are fed into the python ReDoS finder.
N.B. there are differences between javascript and python regex parsing so there may be some errors. I'm [not sure I want](https://hackernoon.com/the-madness-of-parsing-real-world-javascript-regexps-d9ee336df983) to write a JS regex AST! Also, use NodeJS version >=12.
117
+
N.B. there are differences between javascript and python regex parsing so there may be some errors. I'm [not sure I want](https://hackernoon.com/the-madness-of-parsing-real-world-javascript-regexps-d9ee336df983) to write a JS regex AST!
131
118
132
-
## Ruby
133
-
134
-
TODO: not so straight forward to extract the regexes because of the way they are often built up from multiple strings.
135
-
136
-
## PHP
119
+
## Python imports
137
120
138
-
TODO: not so straight forward to extract the regexes because of the way they are often built up from multiple strings. Can maybe grep for simple uses of `preg_match` and pipe into `regexploit`.
121
+
Search for regexes in all the python modules currently installed in your path / env. This means you can `pip install` whatever modules you are interested in and they will be analysed. Cpython code is included.
139
122
140
-
## Golang / anything using re2
123
+
```bash
124
+
regexploit-python-env
125
+
```
141
126
142
-
Unless you specifically use a non-deterministic finite automata, Go code is not vulnerable to this type of ReDoS. It uses `re2`which does not have catastrophic backtracking.
127
+
N.B. this doesn't parse the python code to an AST and will only find regexes compiled automatically on module import. Modules are actually imported, **so code in the modules will be executed**. This is helpful for finding regexes which are built up from smaller strings on load e.g. [CVE-2021-25292 in Pillow](https://github.com/python-pillow/Pillow/commit/3bce145966374dd39ce58a6fc0083f8d1890719c)
143
128
144
129
## JSON / YAML
145
130
131
+
Yaml requires pyyaml, which can be installed with `pip install regexploit[yaml]`.
0 commit comments