A deep investigation into regular expression denial of service (ReDoS) vulnerabilities in JavaScript
  • @towerful
    6•9 months ago

    I really appreciate the “examples in the wild” along with pointing to the solutions in the source code.
    And I’ve now learned about a regex debugger. Which is cool.

    Also funny seeing one of the issues being “validating an email”, which I’m fairly certain the only real way to do this is to check for an @ symbol on the string, and then validate it by sending an actual email.

    I also find it amusing that the solution to problematic regex was to use native string functions. Backing up the “you have a problem, you use regex, now you have 2 problems” saying.
    Although, endsWith was only introduced in 2015. So I can understand someone thinking “regex” (even though a string comparison with a substring is functionally equivalent and probably more understandable than a regex, even if it is a little clunky)

    • @philnashOP
      3•9 months ago

      The only real way to validate an email address is send it an email and see if it arrives! I’m sure many of us have fallen to the urge to validate an email with a regex though, and yes, it’s just too dangerous! I definitely like the simplicity of checking for an @.

      I think regular expressions are actually very tempting to use because they seem hard. I feel like I go through this XKCD comic every time the opportunity to use a regex comes up. But string functions often have the answer. I hope, if this article achieves anything, it just stops people using regex to trim whitespace!

  • Robin
    4•9 months ago

    That was a good read. Didn’t know this is how DOS can be caused by Regex.