noverify
noverify copied to clipboard
regexp lint: detect patterns that can cause catastrophic backtracking
This implementation may be ported to NoVerify:
- https://github.com/superhuman/rxxr2
- https://www.cs.bham.ac.uk/~hxt/research/rxxr2/
It doesn't look simple to port though.
More info on the kinds of patterns we want to detect:
- https://www.regular-expressions.info/catastrophic.html
- https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS
- https://stackoverflow.com/questions/12841970/how-can-i-recognize-an-evil-regex