T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/analyze.py:85
- Finding
- Regular Expression Denial of Service Through an Unrestricted User-Supplied Pattern## Vulnerability Details **File Location**: `scripts/analyze.py`, lines 85–87 and line 120 **Vulnerability Type**: Regular Expression Denial of Service (ReDoS) **Risk Level**: Medium ### Vulnerable Code ```python # Pattern matching if options.pattern: if re.search(options.pattern, line): stats['patterns'][options.pattern] += 1 ``` The pattern originates from an unrestricted command-line argument: ```python parser.add_argument('--pattern', help='Search for regex pattern') ``` ### Technical Analysis The analyzer accepts an arbitrary Python regular expression through `--pattern` and passes it directly to `re.search()`. It evaluates that expression against every complete line in the selected log file. Python's standard `re` engine uses a backtracking implementation and does not provide an execution timeout for this call. Patterns containing nested or ambiguous quantifiers can therefore exhibit catastrophic backtracking on specially structured input. The implementation does not restrict pattern complexity, limit input-line length, precompile and validate the expression, or isolate matching with an enforceable resource limit. For example, an expression structurally similar to `^(a+)+$` can require excessive CPU time when evaluated against a long sequence of `a` characters followed by a nonmatching character. ### Attack Path 1. An attacker supplies or influences the value passed to `--pattern`, or persuades an operator or automated process to use a pathological expression. 2. The selected log file contains a sufficiently long matching or near-matching line. The attacker may be able to inject such content into application or access logs. 3. `analyze_file()` reads the crafted line and invokes `re.search(options.pattern, line)`. 4. The regex engine enters excessive backtracking. 5. The analyzer consumes substantial CPU or becomes unresponsive. Because matching occurs inside the per-line loop, multiple crafted lines can amplify the resource consumpti ...[truncated 464 chars]
- Remediation
- ## Remediation Suggestions 1. Prefer literal substring matching by default and require an explicit option to enable regular expressions. 2. If regex support is necessary, use an engine or execution mechanism that supports enforceable matching timeouts. 3. Reject oversized patterns and impose a maximum length on each input line before regex evaluation. 4. Validate or disallow constructs associated with catastrophic backtracking, while recognizing that validation alone is not a complete defense. 5. Compile the pattern once before processing the file, catch `re.error` separately, and fail with a clear validation message: ```python try: compiled_pattern = re.compile(options.pattern) if options.pattern else None except re.error as exc: print(f"Invalid regular expression: {exc}", file=sys.stderr) return None ``` 6. Execute untrusted analysis jobs with CPU and wall-clock limits and under a low-privilege account. 7. Document that regex patterns must be trusted unless robust timeout and resource controls are implemented.