Skip to content

A tool for testing regular expressions for ReDoS vulnerabilities.

License

Notifications You must be signed in to change notification settings

jkutner/saferegex

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

41 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

SafeRegex Build Status Maven Central

SafeRegex is a tool that tests regular expressions for ReDoS vulnerabilities. In contrast to similar tools, SafeRegex doesn't use plain fuzzing to detect vulnerabilites but uses an approach similar to model checking. This makes it much more effective than plain fuzzers.

Usage

Build the executable JAR:

$ ./mvnw clean package

Run the JAR against an evil regex:

$ java -jar target/saferegex.jar "(a|aa)+"

Testing: (a|aa)+
More than 10000 samples found.
***
This expression is vulnerable.
Sample input: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaab

Or a safe regex:

$ java -jar target/saferegex.jar "(ht|f)tp(s?)\:\/\/[0-9a-zA-Z]([-.a-zA-Z_]*[0-9a-zA-Z])*(:(0-9)*)?(\/?)([a-zA-Z0-9\-\.\?\,\:\'\/\\\+=&%\$#_]*)?"

Testing: (ht|f)tp(s?)\:\/\/[0-9a-zA-Z]([-.a-zA-Z_]*[0-9a-zA-Z])*(:(0-9)*)?(\/?)([a-zA-Z0-9\-\.\?\,\:\'\/\\\+=&%\$#_]*)?
More than 10000 samples found.
************************************************************************************************************************************************************************************************************
*****************************************************************************************************************************
Tests: 3297
Broken samples: 0
This expression is probably not vulnerable for sample sizes < 10000

Usage as a dependency

<dependency>
    <groupId>com.github.jkutner</groupId>
    <artifactId>saferegex</artifactId>
</dependency>

History

The project was created on Feb 16, 2011 by Sebastian Kübeck and hosted on Google Code. This project has been forked from the original and now maintained by Joe Kutner.

License

Apache License, Version 2.0

About

A tool for testing regular expressions for ReDoS vulnerabilities.

Resources

License

Stars

Watchers

Forks

Packages

No packages published