Skip to content
A tool for testing regular expressions for ReDoS vulnerabilities.
Java Shell Batchfile
Branch: master
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
.mvn/wrapper
src
.gitignore
.travis.yml
LICENSE.TXT
README.md
mvnw
mvnw.cmd
pom.xml
release.sh

README.md

SafeRegex Build Status Maven Central

SafeRegex is a tool that tests regular expressions for ReDoS vulnerabilities. In contrast to similar tools, SafeRegex doesn't use plain fuzzing to detect vulnerabilites but uses an approach similar to model checking. This makes it much more effective than plain fuzzers.

Usage

Build the executable JAR:

$ ./mvnw clean package

Run the JAR against an evil regex:

$ java -jar target/saferegex.jar "(a|aa)+"

Testing: (a|aa)+
More than 10000 samples found.
***
This expression is vulnerable.
Sample input: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaab

Or a safe regex:

$ java -jar target/saferegex.jar "(ht|f)tp(s?)\:\/\/[0-9a-zA-Z]([-.a-zA-Z_]*[0-9a-zA-Z])*(:(0-9)*)?(\/?)([a-zA-Z0-9\-\.\?\,\:\'\/\\\+=&%\$#_]*)?"

Testing: (ht|f)tp(s?)\:\/\/[0-9a-zA-Z]([-.a-zA-Z_]*[0-9a-zA-Z])*(:(0-9)*)?(\/?)([a-zA-Z0-9\-\.\?\,\:\'\/\\\+=&%\$#_]*)?
More than 10000 samples found.
************************************************************************************************************************************************************************************************************
*****************************************************************************************************************************
Tests: 3297
Broken samples: 0
This expression is probably not vulnerable for sample sizes < 10000

Usage as a dependency

<dependency>
    <groupId>com.github.jkutner</groupId>
    <artifactId>saferegex</artifactId>
</dependency>

History

The project was created on Feb 16, 2011 by Sebastian Kübeck and hosted on Google Code. This project has been forked from the original and now maintained by Joe Kutner.

License

Apache License, Version 2.0

You can’t perform that action at this time.