Class: Contrast::Agent::Assess::Rule::Redos

Inherits:
Base
  • Object
show all
Defined in:
lib/contrast/agent/assess/rule/redos.rb

Overview

A regexp is only vulnerable to REDOS if it’s going to run with pathologically bad performance. We report a vulnerability if the regexp is liable to run with quadratic time for some input. This vastly errs on the side of false positives.

Constant Summary collapse

NAME = 
'redos'

Class Method Summary collapse

Methods inherited from Base

#enabled?, #excluded?, #initialize, #name, #postfilter, #prefilter, #stream_safe?

Methods included from Components::Interface

included

Constructor Details

This class inherits a constructor from Contrast::Agent::Assess::Rule::Base

Class Method Details

.name ⇒ Object 



16
17
18
 
# File 'lib/contrast/agent/assess/rule/redos.rb', line 16

def name
  NAME
end

.regexp_complexity_check(context, trigger_node, source, object, ret, *args) ⇒ Object 



20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
 
# File 'lib/contrast/agent/assess/rule/redos.rb', line 20

def regexp_complexity_check context, trigger_node, source, object, ret, *args
  # we can arrive here either from:
  #   regexp =~ string
  #   string =~ regexp
  #   regexp.match string
  #
  # so object/args[0] can be string/regexp or regexp/string.
  regexp = object.is_a?(Regexp) ? object : args[0]
  string = object.is_a?(String) ? object : args[0]

  # (1) regexp must be exploitable
  return unless regexp_vulnerable?(regexp)

  # (2) regexp must evaluate against user input
  return unless trigger_node.violated?(string)

  Contrast::Agent::Assess::Policy::TriggerMethod.build_finding(context, trigger_node, source, object, ret, args)
end