T09 · Insecure Skill Coding Practices
- Location
scripts/analyze.py:85- Finding
Regular Expression Denial of Service Through an Unrestricted User-Supplied Pattern
- Content
View full analysis
Vulnerability Details
File Location:
scripts/analyze.py, lines 85–87 and line 120
Vulnerability Type: Regular Expression Denial of Service (ReDoS)
Risk Level: MediumVulnerable Code
python # Pattern matching if options.pattern: if re.search(options.pattern, line): stats['patterns'][options.pattern] += 1The pattern originates from an unrestricted command-line argument:
python parser.add_argument('--pattern', help='Search for regex pattern')Technical Analysis
The analyzer accepts an arbitrary Python regular expression through
--patternand passes it directly tore.search(). It evaluates that expression against every complete line in the selected log file.Python's standard
reengine uses a backtracking implementation and does not provide an execution timeout for this call. Patterns containing nested or ambiguous quantifiers can therefore exhibit catastrophic backtracking on specially structured input. The implementation does not restrict pattern complexity, limit input-line length, precompile and validate the expression, or isolate matching with an enforceable resource limit.For example, an expression structurally similar to
^(a+)+$can require excessive CPU time when evaluated against a long sequence ofacharacters followed by a nonmatching character.Attack Path
- An attacker supplies or influences the value passed to
--pattern, or persuades an operator or automated process to use a pathological expression. - The selected log file contains a sufficiently long matching or near-matching line. The attacker may be able to inject such content into application or access logs.
analyze_file()reads the crafted line and invokesre.search(options.pattern, line).- The regex engine enters excessive backtracking.
- The analyzer consumes substantial CPU or becomes unresponsive. Because matching occurs inside the per-line loop, multiple crafted lines can amplify the resource consumpti ...[truncated 464 chars]
- An attacker supplies or influences the value passed to
- Remediation
View remediation
Remediation Suggestions
- Prefer literal substring matching by default and require an explicit option to enable regular expressions.
- If regex support is necessary, use an engine or execution mechanism that supports enforceable matching timeouts.
- Reject oversized patterns and impose a maximum length on each input line before regex evaluation.
- Validate or disallow constructs associated with catastrophic backtracking, while recognizing that validation alone is not a complete defense.
- Compile the pattern once before processing the file, catch
re.errorseparately, and fail with a clear validation message:
python try: compiled_pattern = re.compile(options.pattern) if options.pattern else None except re.error as exc: print(f"Invalid regular expression: {exc}", file=sys.stderr) return None- Execute untrusted analysis jobs with CPU and wall-clock limits and under a low-privilege account.
- Document that regex patterns must be trusted unless robust timeout and resource controls are implemented.