rspec/rules/S5852/description.adoc

6 lines
868 B
Plaintext
Raw Normal View History

2021-01-27 13:42:22 +01:00
Most of the regular expression engines use ``++backtracking++`` to try all possible execution paths of the regular expression when evaluating an input, in some cases it can cause performance issues, called ``++catastrophic backtracking++`` situations. In the worst case, the complexity of the regular expression is exponential in the size of the input, this means that a small carefully-crafted input (like 20 chars) can trigger ``++catastrophic backtracking++`` and cause a denial of service of the application. Super-linear regex complexity can lead to the same impact too with, in this case, a large carefully-crafted input (thousands chars).
2020-06-30 12:50:28 +02:00
This rule detects regular expression patterns known to have potential performance issues:
2021-01-27 13:42:22 +01:00
* ``++Nested quantifiers++`` which are quantifiers inside a group that is itself repeated by a quantifier (eg: ``++/(a+)+/++``).