redos detection misses issues if the regex is provided via a variable #35
Comments
|
Hi @barrywhart, Good catch - you're correct that the ReDoS rule doesn't handle constant propagation. There's opportunity to handle this on a basic, intra-procedural level. Dlint achieves this for some rules with the Handling intra-procedural variables and intra-module primitive constants (string, int, float, etc) seems reasonable. Although this will require tracking a lot of additional state, and of course comes with edge cases (what if a global is overwritten?). The good news is nearly every rule would benefit from this functionality, not just the ReDoS rule. |
dlint detects redos issues only if the regex is hardcoded into the place where the re function is called. If the regex is stored in a constant, it doesn't catch it.
For example, this code would be flagged:
But this would not:
In the original code where I discovered this,
URL_REGEXwas defined in a different module, then imported. It would be great to handle this as well (i.e.. the regex is in a variable in the same or in a different module than there.call).The text was updated successfully, but these errors were encountered: