Enhances Regex Analysis and Symfony Integration #69
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Introduces a new analyzer to scan Symfony Validator constraints for regex syntax errors and ReDoS vulnerabilities. Integrates this analysis into the bundle's cache warmer and console command, providing comprehensive regex validation across routes and validator definitions. Renames the issue reporting class to `RegexAnalysisIssue` to accommodate generalized findings from various sources. Updates Symfony dependencies to explicitly support version 8.0.
Includes the problematic regex pattern directly in all analysis issues (invalid, ReDoS, and complexity warnings). This provides crucial context for debugging and resolving regex-related problems. Truncates excessively long patterns in issue messages to maintain readability in logs and console output. Modernizes the console command definition by adopting the `#[AsCommand]` attribute.
Adds a new configuration option `regex_parser.analysis.ignore_patterns` for Symfony applications. This allows users to specify regex fragments that should be skipped during ReDoS and complexity analysis. The analysis logic in `RouteRequirementAnalyzer` and `ValidatorRegexAnalyzer` now automatically identifies and ignores common, trivially safe patterns and user-defined patterns. This significantly reduces false positives and noise in reports, ensuring focus on genuinely problematic regexes. Also renames `RegexAnalysisIssue` to `AnalysisIssue` for a more general and less specific naming. Detailed pattern information is now included in issue messages for improved debugging.
Improves ReDoS detection by introducing `CharSet` and `CharSetAnalyzer` to identify mutually exclusive character sets between adjacent regex elements. This refinement helps prevent false positives for nested unbounded quantifiers when backtracking is naturally avoided. Refactors ignored patterns for ReDoS analysis into the central `Regex` service, replacing hardcoded Symfony `Requirement` constants in analyzer classes. This provides a more flexible and configurable approach to exclude known safe patterns.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This pull request significantly enhances regex analysis capabilities by introducing character set boundary awareness for improved ReDoS detection and allowing specific patterns to be ignored from analysis. It also extends the scope of regex validation to Symfony Validator constraints and upgrades Symfony dependencies to version 8.0.
Key changes include:
ValidatorRegexAnalyzer) to detect issues withinSymfony\Component\Validator\Constraints\Regexconstraints, integrating this analysis into the cache warmer and console command.AnalysisIssueclass and includes the problematic pattern in warning/error messages for better context.^8.0.These improvements lead to more precise regex security and complexity analysis across Symfony applications.
Type of Change
Related Issue
Fixes #(issue number)
Testing
Checklist
phpstanandphpunit