Skip to content

TRAP v2.1.1 — ReDoS check

Choose a tag to compare

View all tags
@bikr bikr released this 01 Jul 16:25
· 6 commits to main since this release
v2.1.1
d886c7b

A small, additive hardening release. No breaking changes — every prior verdict still holds.

What's new

  • Regex denial of service (ReDoS) check (Phase 3). TRAP now enumerates the regexes that run against untrusted input and flags any that can backtrack catastrophically — nested or overlapping quantifiers ((a+)+, (.*)*) or unbounded alternation against unbounded input. It calls out that a single crafted string can pin a CPU core, and on a single-threaded runtime (e.g. Node) freeze every unrelated request in flight — then requires a concrete fix (length cap, anchoring, or a linear-time engine like RE2), not just "review the regex."

Links

Find it useful? https://www.buymeacoffee.com/bikra

Assets 2
Loading