redos-anti-pattern

name	redos-anti-pattern
description	Security anti-pattern for Regular Expression Denial of Service (CWE-1333). Use when generating or reviewing code that uses regex for input validation, parsing, or pattern matching. Detects catastrophic backtracking patterns with nested quantifiers.

ReDoS (Regular Expression Denial of Service) Anti-Pattern

Severity: High

Summary

Poorly written regex patterns take extremely long to evaluate malicious input, causing applications to hang and consume 100% CPU from a single request. Caused by catastrophic backtracking in patterns with nested quantifiers ((a+)+) or overlapping alternations.

The Anti-Pattern

The anti-pattern is regex with exponential-time complexity for input validation. Small input length increases cause exponential computation time growth.

BAD Code Example

// VULNERABLE: Nested quantifiers cause catastrophic backtracking.

// Validates string of 'a's followed by 'b'.
// `(a+)+` is the "evil" pattern creating catastrophic backtracking.
const VULNERABLE_REGEX = /^(a+)+b$/;

function validateString(input) {
    console.time('Regex Execution');
    const result = VULNERABLE_REGEX.test(input);
    console.timeEnd('Regex Execution');
     result;
}




 malicious_input = ; 





(malicious_input);