recognize ranges without upper bounds

erik-krogh · erik-krogh · commit 1a8b6d741466 · 2022-01-07T18:38:01.000+01:00
diff --git a/javascript/ql/lib/semmle/javascript/security/performance/ReDoSUtil.qll b/javascript/ql/lib/semmle/javascript/security/performance/ReDoSUtil.qll
@@ -550,7 +550,10 @@ private class EffectivelyPlus extends RegExpTerm {
   EffectivelyPlus() {
     this instanceof RegExpPlus
     or
-    exists(RegExpRange range | range.getLowerBound() = 1 and range.getUpperBound() >= 30 |
+    exists(RegExpRange range |
+      range.getLowerBound() = 1 and
+      (range.getUpperBound() >= 30 or not exists(range.getUpperBound()))
+    |
       this = range
     )
   }
@@ -564,7 +567,10 @@ private class EffectivelyStar extends RegExpTerm {
   EffectivelyStar() {
     this instanceof RegExpStar
     or
-    exists(RegExpRange range | range.getLowerBound() = 0 and range.getUpperBound() >= 30 |
+    exists(RegExpRange range |
+      range.getLowerBound() = 0 and
+      (range.getUpperBound() >= 30 or not exists(range.getUpperBound()))
+    |
       this = range
     )
   }
diff --git a/javascript/ql/test/query-tests/Performance/ReDoS/PolynomialBackTracking.expected b/javascript/ql/test/query-tests/Performance/ReDoS/PolynomialBackTracking.expected
@@ -323,9 +323,10 @@
 | regexplib/strings.js:40:3:40:5 | \\w+ | Strings with many repetitions of 'a' can start matching anywhere after the start of the preceeding (\\w+)\\s+\\1 |
 | regexplib/strings.js:48:3:48:12 | [^\\.\\?\\!]* | Strings with many repetitions of ' ' can start matching anywhere after the start of the preceeding ([^\\.\\?\\!]*)[\\.\\?\\!] |
 | regexplib/strings.js:49:3:49:5 | \\S+ | Strings with many repetitions of '!' can start matching anywhere after the start of the preceeding (\\S+)\\x20{2,}(?=\\S+) |
-| regexplib/strings.js:53:25:53:33 | [a-z0-9]+ | Strings with many repetitions of '0' can start matching anywhere after the start of the preceeding [a-z0-9]+ |
+| regexplib/strings.js:53:4:53:12 | [a-z0-9]+ | Strings with many repetitions of '0.00' can start matching anywhere after the start of the preceeding [a-z0-9]+ |
+| regexplib/strings.js:53:25:53:33 | [a-z0-9]+ | Strings starting with '0' and with many repetitions of '0' can start matching anywhere after the start of the preceeding [a-z0-9]+ |
 | regexplib/strings.js:53:44:53:52 | [a-z0-9]+ | Strings with many repetitions of '00' can start matching anywhere after the start of the preceeding [a-z0-9]+ |
-| regexplib/strings.js:53:65:53:73 | [a-z0-9]+ | Strings with many repetitions of '0' can start matching anywhere after the start of the preceeding [a-z0-9]+ |
+| regexplib/strings.js:53:65:53:73 | [a-z0-9]+ | Strings starting with '0' and with many repetitions of '0' can start matching anywhere after the start of the preceeding [a-z0-9]+ |
 | regexplib/strings.js:54:20:54:22 | \\w+ | Strings with many repetitions of 'a' can start matching anywhere after the start of the preceeding (NOT)?(\\s*\\(*)\\s*(\\w+)\\s*(=\|<>\|<\|>\|LIKE\|IN)\\s*(\\(([^\\)]*)\\)\|'([^']*)'\|(-?\\d*\\.?\\d+))(\\s*\\)*\\s*)(AND\|OR)? |
 | regexplib/strings.js:56:52:56:53 | .+ | Strings starting with 'PRN.' and with many repetitions of '.' can start matching anywhere after the start of the preceeding .* |
 | regexplib/strings.js:57:36:57:38 | .*? | Strings starting with '?se[A' and with many repetitions of '?se[Aa' can start matching anywhere after the start of the preceeding (?s)(?:\\e\\[(?:(\\d+);?)*([A-Za-z])(.*?))(?=\\e\\[\|\\z) |
@@ -532,3 +533,4 @@
 | tst.js:404:6:405:7 | (g\|gg)* | Strings with many repetitions of 'g' can start matching anywhere after the start of the preceeding (g\|gg)*h$ |
 | tst.js:407:128:407:129 |  * | Strings starting with '0/*' and with many repetitions of ' ' can start matching anywhere after the start of the preceeding \\s* |
 | tst.js:409:23:409:29 | [\\w.-]* | Strings starting with '//' and with many repetitions of '//' can start matching anywhere after the start of the preceeding (\\/(?:\\/[\\w.-]*)*){0,1}:([\\w.-]+) |
+| tst.js:411:15:411:19 | a{1,} | Strings with many repetitions of 'a' can start matching anywhere after the start of the preceeding (a{1,})* |
diff --git a/javascript/ql/test/query-tests/Performance/ReDoS/ReDoS.expected b/javascript/ql/test/query-tests/Performance/ReDoS/ReDoS.expected
@@ -70,6 +70,8 @@
 | regexplib/strings.js:19:31:19:57 | [a-z&#230;&#248;&#229;0-9]+ | This part of the regular expression may cause exponential backtracking on strings starting with '#@' and containing many repetitions of '#'. |
 | regexplib/strings.js:19:69:19:95 | [a-z&#230;&#248;&#229;0-9]+ | This part of the regular expression may cause exponential backtracking on strings starting with '#@#' and containing many repetitions of '##'. |
 | regexplib/strings.js:47:3:47:5 | \\S* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '!'. |
+| regexplib/strings.js:53:4:53:12 | [a-z0-9]+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '00.'. |
+| regexplib/strings.js:53:14:53:24 | [\\-a-z0-9]* | This part of the regular expression may cause exponential backtracking on strings starting with '0' and containing many repetitions of '00.0'. |
 | regexplib/strings.js:57:17:57:19 | \\d+ | This part of the regular expression may cause exponential backtracking on strings starting with '?se[' and containing many repetitions of '9'. |
 | regexplib/strings.js:81:17:81:19 | \\d+ | This part of the regular expression may cause exponential backtracking on strings starting with '?se[' and containing many repetitions of '9'. |
 | regexplib/strings.js:91:3:91:5 | \\S* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '!'. |
@@ -196,3 +198,4 @@
 | tst.js:400:6:401:1 | (e\|ee)* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'ee'. |
 | tst.js:404:6:405:7 | (g\|gg)* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'gg'. |
 | tst.js:407:125:407:127 | \\s* | This part of the regular expression may cause exponential backtracking on strings starting with '0/*' and containing many repetitions of ' ;0'. |
+| tst.js:411:15:411:19 | a{1,} | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'a'. |
diff --git a/javascript/ql/test/query-tests/Performance/ReDoS/tst.js b/javascript/ql/test/query-tests/Performance/ReDoS/tst.js
@@ -406,4 +406,6 @@ var bad97 = new RegExp(
 
 var bad98 = /^(?:\*\/\*|[a-zA-Z0-9][a-zA-Z0-9!\#\$&\-\^_\.\+]{0,126}\/(?:\*|[a-zA-Z0-9][a-zA-Z0-9!\#\$&\-\^_\.\+]{0,126})(?:\s* *; *[a-zA-Z0-9][a-zA-Z0-9!\#\$&\-\^_\.\+]{0,126}(?:="?[a-zA-Z0-9][a-zA-Z0-9!\#\$&\-\^_\.\+]{0,126}"?)?\s*)*)$/;
 
-var good48 = /(\/(?:\/[\w.-]*)*){0,1}:([\w.-]+)/;
+var good48 = /(\/(?:\/[\w.-]*)*){0,1}:([\w.-]+)/;
+
+var bad99 = /(a{1,})*b/;
diff --git a/python/ql/lib/semmle/python/security/performance/ReDoSUtil.qll b/python/ql/lib/semmle/python/security/performance/ReDoSUtil.qll
@@ -550,7 +550,10 @@ private class EffectivelyPlus extends RegExpTerm {
   EffectivelyPlus() {
     this instanceof RegExpPlus
     or
-    exists(RegExpRange range | range.getLowerBound() = 1 and range.getUpperBound() >= 30 |
+    exists(RegExpRange range |
+      range.getLowerBound() = 1 and
+      (range.getUpperBound() >= 30 or not exists(range.getUpperBound()))
+    |
       this = range
     )
   }
@@ -564,7 +567,10 @@ private class EffectivelyStar extends RegExpTerm {
   EffectivelyStar() {
     this instanceof RegExpStar
     or
-    exists(RegExpRange range | range.getLowerBound() = 0 and range.getUpperBound() >= 30 |
+    exists(RegExpRange range |
+      range.getLowerBound() = 0 and
+      (range.getUpperBound() >= 30 or not exists(range.getUpperBound()))
+    |
       this = range
     )
   }
diff --git a/ruby/ql/lib/codeql/ruby/security/performance/ReDoSUtil.qll b/ruby/ql/lib/codeql/ruby/security/performance/ReDoSUtil.qll
@@ -548,7 +548,10 @@ private class EffectivelyPlus extends RegExpTerm {
   EffectivelyPlus() {
     this instanceof RegExpPlus
     or
-    exists(RegExpRange range | range.getLowerBound() = 1 and range.getUpperBound() >= 30 |
+    exists(RegExpRange range |
+      range.getLowerBound() = 1 and
+      (range.getUpperBound() >= 30 or not exists(range.getUpperBound()))
+    |
       this = range
     )
   }
@@ -562,7 +565,10 @@ private class EffectivelyStar extends RegExpTerm {
   EffectivelyStar() {
     this instanceof RegExpStar
     or
-    exists(RegExpRange range | range.getLowerBound() = 0 and range.getUpperBound() >= 30 |
+    exists(RegExpRange range |
+      range.getLowerBound() = 0 and
+      (range.getUpperBound() >= 30 or not exists(range.getUpperBound()))
+    |
       this = range
     )
   }

Original file line number	Diff line number	Diff line change
`@@ -550,7 +550,10 @@ private class EffectivelyPlus extends RegExpTerm {`
`550`	`550`	`EffectivelyPlus() {`
`551`	`551`	`this instanceof RegExpPlus`
`552`	`552`	`or`
`553`		`- exists(RegExpRange range \| range.getLowerBound() = 1 and range.getUpperBound() >= 30 \|`
	`553`	`+ exists(RegExpRange range \|`
	`554`	`+ range.getLowerBound() = 1 and`
	`555`	`+ (range.getUpperBound() >= 30 or not exists(range.getUpperBound()))`
	`556`	`+ \|`
`554`	`557`	`this = range`
`555`	`558`	`)`
`556`	`559`	`}`
`@@ -564,7 +567,10 @@ private class EffectivelyStar extends RegExpTerm {`
`564`	`567`	`EffectivelyStar() {`
`565`	`568`	`this instanceof RegExpStar`
`566`	`569`	`or`
`567`		`- exists(RegExpRange range \| range.getLowerBound() = 0 and range.getUpperBound() >= 30 \|`
	`570`	`+ exists(RegExpRange range \|`
	`571`	`+ range.getLowerBound() = 0 and`
	`572`	`+ (range.getUpperBound() >= 30 or not exists(range.getUpperBound()))`
	`573`	`+ \|`
`568`	`574`	`this = range`
`569`	`575`	`)`
`570`	`576`	`}`
Original file line number	Diff line number	Diff line change
`@@ -548,7 +548,10 @@ private class EffectivelyPlus extends RegExpTerm {`
`548`	`548`	`EffectivelyPlus() {`
`549`	`549`	`this instanceof RegExpPlus`
`550`	`550`	`or`
`551`		`- exists(RegExpRange range \| range.getLowerBound() = 1 and range.getUpperBound() >= 30 \|`
	`551`	`+ exists(RegExpRange range \|`
	`552`	`+ range.getLowerBound() = 1 and`
	`553`	`+ (range.getUpperBound() >= 30 or not exists(range.getUpperBound()))`
	`554`	`+ \|`
`552`	`555`	`this = range`
`553`	`556`	`)`
`554`	`557`	`}`
`@@ -562,7 +565,10 @@ private class EffectivelyStar extends RegExpTerm {`
`562`	`565`	`EffectivelyStar() {`
`563`	`566`	`this instanceof RegExpStar`
`564`	`567`	`or`
`565`		`- exists(RegExpRange range \| range.getLowerBound() = 0 and range.getUpperBound() >= 30 \|`
	`568`	`+ exists(RegExpRange range \|`
	`569`	`+ range.getLowerBound() = 0 and`
	`570`	`+ (range.getUpperBound() >= 30 or not exists(range.getUpperBound()))`
	`571`	`+ \|`
`566`	`572`	`this = range`
`567`	`573`	`)`
`568`	`574`	`}`