Skip to content

[Bug] Potential ReDoS or high latency in rule-based scanner on large code strings #936

@Abhishek-Ag-1112

Description

@Abhishek-Ag-1112

Summary

The core rule-based assistant scanner runs over 40 intensive regular expression pattern evaluations (BUG_PATTERNS) on raw user strings without a designated maximum string/character length constraint. When analyzing highly complex or multi-megabyte files via the direct text analyzer, this triggers severe thread-blocking latency spikes and potential Regular Expression Denial of Service (ReDoS) vulnerabilities.

Steps To Reproduce

  1. Start the local backend service using uvicorn app.main:app --reload.
  2. Open the frontend workspace (frontend/index.html) or access the /debugging/ endpoint via Swagger docs or curl.
  3. Paste a highly nested or exceptionally large minified code snippet (exceeding 50,000 lines or 2MB) into the analyzer canvas.
  4. Click Analyze Code or dispatch the payload to trigger the backend execution loop.

Expected Behavior

The backend should implement an early validation gateway (e.g., maximum character length ceiling or regex matching timeout protection) that gracefully rejects or truncates excessively large payloads before firing complex pattern evaluations, returning an HTTP 400 Bad Request or an informative warning array.

Actual Behavior

The uvicorn main loop completely blocks execution while processing sequentially intensive regex matching over massive strings, spiking server response times past acceptable timeframes or locking completely under heavy payloads.

Environment

  • OS: macOS / Windows / Linux
  • Browser (if frontend): N/A (Backend API issue)
  • Python version (if backend): 3.12+

Logs/Screenshots

No explicit exception logged; the application thread remains unresponsive/blocked in code_assistant.py during sequential pattern loops.

Metadata

Metadata

Assignees

No one assigned

    Labels

    closedClosed due to assignment or outdated issue

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions