Single-character super-linear RegExps

^{_{what a name...}}

A library to find JS RegExp with super-linear worst-case time complexity for attack strings that repeat a single character.

The static analysis method implemented by this library focuses on finding attack string tuples where a single character is repeated. This major limitation allows the library to be fast while also offering decent support for backreferences and assertions.

This library is not intended as a full static analysis to guard against super-linear worst-case time complexity. It is meant to be as a supplementary analysis on top of existing general analysis methods that don't (or don't fully) support advanced regex features, or as a lightweight analysis on top of existing full (but heavyweight) analysis methods. Libraries that provide such general or near-full analysis are known as recheck and vuln-regex-detector. You may consider using these libraries as well.

Usage

This library exports only a single function, analyse, which takes a RegExp literal and returns a list of reports that show the quantifiers causing super-linear worst-case time complexity.

Documentation

For more information on the exact inputs and outputs of each function, see the full API documentation.

• Latest release
• Development

Limitations

Analysis

This library is implemented using a very limited static analysis method that can only find attack strings where a single character is repeated. Attack strings are generated from a tuple (x,y,z) such that every string s = xyⁿz (or x + y.repeat(n) + z for JS folks) takes O(n^p) or O(2ⁿ) many steps to reject, p>1. This analysis method can only find tuples where y is a single character. E.g. the polynomial backtracking in /^(ab)*(ab)*$/ for (x,y,z) = ("", "ab", "c") cannot be detected by this library because y is not a single character.

However, this limitation allows the static analysis method to be quick and to provide good (but not perfect) support for backreferences and assertions (e.g. \b, `(?