Evaluating regular expressions against input strings is potentially an extremely CPU-intensive task. Specially crafted regular expressions such as ``(a+)\+s`` will take several seconds to evaluate the input string ``aaaaaaaaaaaaaaaaaaaaaaaaaaaaabs``. The problem is that with every additional ``a`` character added to the input, the time required to evaluate the regex doubles. However, the equivalent regular expression, ``a\+s`` (without grouping) is efficiently evaluated in milliseconds and scales linearly with the input size.
Evaluating such regular expressions opens the door to https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS[Regular expression Denial of Service (ReDoS)] attacks. In the context of a web application, attackers can force the web server to spend all of its resources evaluating regular expressions thereby making the service inaccessible to genuine users.
This rule flags any execution of a hardcoded regular expression which has at least 3 characters and at least two instances of any of the following characters: ``*\+\{``.
