This library exports only the API called check. It takes a RegExp pattern source and flags to be checked (and a configuration optionally), then it returns the analysis result.

const { check } = require("@makenowjust-labo/redos");

console.log(check("^(a|a)*$", ""));
// {
//   status: 'vulnerable',
//   used: 'automaton',
//   attack: 'aaaaaaaaaaaaaaaaaaaaa\x00',
//   complexity: {
//     type: 'exponential',
//     witness: { pumps: [ { prefix: 'a', pump: 'a' } ], suffix: '\x00' }
//   }
// }

Configuration

A configuration parameter specifies as the 3rd argument of the check function.

console.log(check("^(a|a)*$", "", { timeout: 1000, checker: "fuzz" }));

The following parameters are available.

`timeout`

An integer value of timeout duration milliseconds. (default: undefined)

When undefined is specified, it means there is no timeout.

`checker`

A checker name to use. (default: 'hybrid')

There are three checkers:

'automaton': A checker which works based on automaton theory. It can analyze a ReDoS vulnerability of the RegExp without false positives, however, it needs some minutes against some RegExps and it does not support some syntax.
'fuzz': A checker based on fuzzing. It can detect a ReDoS vulnerability against all RegExp syntax including back-references and look-around assertions. However, it needs some seconds on average and it may cause false negatives.
'hybrid': A checker which combines the automaton based checker and the fuzz checker. If the RegExp is supported by the automaton based checker and some thresholds are passed, it uses the automaton based checker. Otherwise, it falls back to the fuzz checker.

The hybrid checker performs better than others in many cases.

Other parameters to specify detailed behavior

And, there are other parameters to specify detailed behavior. They are set to perform better as the default, so it is rare to specify them and it needs to know the checkers in depth to set the correct value.

`maxAttackSize`

An integer value of a maximum length of an attack string. (default: 10_000)

The checker finds a vulnerable string not to exceed this length.

`attackLimit`

An integer value of a limit of VM execution steps. (default: 1_000_000)

The checker assumes the RegExp is vulnerable when a string exists against which steps exceed the limit.

`stepRate`

A floating-point number value which represents a ratio of a character to VM execution steps. (default: 1.5)

It is used to build an attack string from the complexity witness.

`randomSeed`

An integer value of seed for pseudo-random number generator in fuzzing. (default: undefined)

When undefined is specified, it uses a system default seed.

`seedLimit`

An integer value of a limit of VM execution steps on the seeding phase. (default: 10_000)

`populationLimit`

An integer value of a limit of VM execution steps on the incubation phase. (default: 100_000)

`crossSize`

An integer value of the number of crossings on one generation. (default: 25)

`mutateSize`

An integer value of the number of mutations on one generation. (default: 50)

`maxSeedSize`

An integer value of a maximum size of a seed set. (default: 50)

`maxGenerationSize`

An integer value of a maximum size of a living population on one generation. (default: 100)

`maxIteration`

An integer value of a number of iterations on the incubation phase. (default: 30)

`maxDegree`

An integer value of a maximum degree to attempt on building an attack string. (default: 4)

`maxRepeatCount`

An integer value of a limit of repetition count in the RegExp. (default: 20)

If the RegExp exceeds this limit on the hybrid checker, it switches to use the fuzz checker to analyze instead of the automaton based checker.

`maxNFASize`

An integer value of a maximum size of the transition function of NFA. (default: 40000)

If the NFA's transition function exceeds this limit on the hybrid checker, it switches to use fuzz checker to analyze instead of the automaton based checker.

`maxPatternSize`

An integer value of maximum size of the pattern. (default: 1500)

If the pattern size exceeds this limit on the hybrid checker, it switches to use fuzz checker to analyze instead of the automaton based checker.

License

MIT License.

2020 (C) TSUYUSATO "MakeNowJust" Kitsune

Keywords

FAQs

What is @makenowjust-labo/redos?

Is @makenowjust-labo/redos popular?

Is @makenowjust-labo/redos well maintained?

Package last updated on 04 Dec 2020

Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install

@makenowjust-labo/redos