The impact of regular expression denial of service (ReDoS) in practice: an empirical study at the ecosystem scale
The impact of regular expression denial of service (ReDoS) in practice: an empirical study at the ecosystem scale
复制标题
DOI：
10.1145/3236024.3236027
复制
发表时间：
2018-10
期刊：
影响因子：
--
通讯作者：
James C. Davis;Christy A. Coghlan;Francisco Servant;Dongyoon Lee
中科院分区：
文献类型：
--
作者：
James C. Davis;Christy A. Coghlan;Francisco Servant;Dongyoon Lee
正则表达式（Regexes）是一种自动操纵文本的一种强大和强大的手段，如果Regex具有超线性最差的复杂性，则可以理解拒绝服务媒介。 GEX抗模式可能会导致这种复杂性，我们迫切地研究了重做的三个主要方面是意外的：超级线性的回复事件在实践中，如何预防它们，以及如何在两种流行的编程语言中修复它们。应用领域。这些发现的动机进一步研究，因为许多模块容易受到影响，避免它的现有机制是不够的。
Regular expressions (regexes) are a popular and powerful means of automatically manipulating text. Regexes are also an understudied denial of service vector (ReDoS). If a regex has super-linear worst-case complexity, an attacker may be able to trigger this complexity, exhausting the victim’s CPU resources and causing denial of service. Existing research has shown how to detect these superlinear regexes, and practitioners have identified super-linear regex anti-pattern heuristics that may lead to such complexity. In this paper, we empirically study three major aspects of ReDoS that have hitherto been unexplored: the incidence of super-linear regexes in practice, how they can be prevented, and how they can be repaired. In the ecosystems of two of the most popular programming languages — JavaScript and Python – we detected thousands of super-linear regexes affecting over 10,000 modules across diverse application domains. We also found that the conventional wisdom for super-linear regex anti-patterns has few false negatives but many false positives; these anti-patterns appear to be necessary, but not sufficient, signals of super-linear behavior. Finally, we found that when faced with a super-linear regex, developers favor revising it over truncating input or developing a custom parser, regardless of whether they had been shown examples of all three fix strategies. These findings motivate further research into ReDoS, since many modules are vulnerable to it and existing mechanisms to avoid it are insufficient. We believe that ReDoS vulnerabilities are a larger threat in practice than might have been guessed.