Metadata

ID: dart-security/regex-dos

Language: Dart

Severity: Warning

Category: Security

CWE: 1333

Description

Regular expressions with nested quantifiers such as (a+)+, (.*)*, or ([a-z]+)+ cause catastrophic backtracking on crafted input, consuming exponential time and hanging the application. Rewrite the pattern to eliminate ambiguous grouping, use possessive quantifiers where supported, or enforce input-length limits before matching untrusted strings.

Non-Compliant Code Examples

void main() {
  final a = RegExp(r'(a+)+');
  final b = RegExp('(.*)*');
  final c = RegExp(r'([a-z]+)+');
}

Compliant Code Examples

void main() {
  final group = RegExp(r'(abc)+');
  final single = RegExp(r'[a-z]+');
  final sequential = RegExp(r'a+b+');
  final alternation = RegExp(r'(foo|bar)+');
  final bounded = RegExp(r'\d{1,3}');
  final boundedOuter = RegExp(r'(a+){2}');
  final ipv4 = RegExp(r'(\d{1,3}\.){3}\d{1,3}');
  final nestedNoQuant = RegExp(r'((abc))+');
}

Seamless integrations. Try Datadog Code Security

Datadog Code Security