46 lines
2.0 KiB
Plaintext
46 lines
2.0 KiB
Plaintext
|
include::../description.adoc[]
|
||
|
|
|
||
|
|
include::../ask-yourself.adoc[]
|
||
|
|
|
||
|
|
include::../recommended.adoc[]
|
||
|
|
|
||
|
|
== Sensitive Code Example
|
||
|
|
|
||
|
|
The first regex evaluation will never end in <code>OpenJDK</code> <= 9 and the second regex evaluation will never end in any versions of <code>OpenJDK</code>:
|
||
|
|
----
|
||
|
|
java.util.regex.Pattern.compile("(a+)+").matcher(
|
||
|
|
"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"+
|
||
|
|
"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"+
|
||
|
|
"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"+
|
||
|
|
aaaaaaaaaaaaaaa!").matches(); // Sensitive
|
||
|
|
|
||
|
|
java.util.regex.Pattern.compile("(h|h|ih(((i|a|c|c|a|i|i|j|b|a|i|b|a|a|j))+h)ahbfhba|c|i)*").matcher(
|
||
|
|
"hchcchicihcchciiicichhcichcihcchiihichiciiiihhcchi"+
|
||
|
|
"cchhcihchcihiihciichhccciccichcichiihcchcihhicchcciicchcccihiiihhihihihi"+
|
||
|
|
"chicihhcciccchihhhcchichchciihiicihciihcccciciccicciiiiiiiiicihhhiiiihchccch"+
|
||
|
|
"chhhhiiihchihcccchhhiiiiiiiicicichicihcciciihichhhhchihciiihhiccccccciciihh"+
|
||
|
|
"ichiccchhicchicihihccichicciihcichccihhiciccccccccichhhhihihhcchchihih"+
|
||
|
|
"iihhihihihicichihiiiihhhhihhhchhichiicihhiiiiihchccccchichci").matches(); // Sensitive
|
||
|
|
----
|
||
|
|
|
||
|
|
== Compliant Solution
|
||
|
|
|
||
|
|
Possessive quantifiers do not keep backtracking positions, thus can be used, if possible, to avoid performance issues:
|
||
|
|
----
|
||
|
|
java.util.regex.Pattern.compile("(a+)++").matcher(
|
||
|
|
"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"+
|
||
|
|
"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"+
|
||
|
|
"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"+
|
||
|
|
aaaaaaaaaaaaaaa!").matches(); // Compliant
|
||
|
|
|
||
|
|
java.util.regex.Pattern.compile("(h|h|ih(((i|a|c|c|a|i|i|j|b|a|i|b|a|a|j))+h)ahbfhba|c|i)*+").matcher(
|
||
|
|
"hchcchicihcchciiicichhcichcihcchiihichiciiiihhcchi"+
|
||
|
|
"cchhcihchcihiihciichhccciccichcichiihcchcihhicchcciicchcccihiiihhihihihi"+
|
||
|
|
"chicihhcciccchihhhcchichchciihiicihciihcccciciccicciiiiiiiiicihhhiiiihchccch"+
|
||
|
|
"chhhhiiihchihcccchhhiiiiiiiicicichicihcciciihichhhhchihciiihhiccccccciciihh"+
|
||
|
|
"ichiccchhicchicihihccichicciihcichccihhiciccccccccichhhhihihhcchchihih"+
|
||
|
|
"iihhihihihicichihiiiihhhhihhhchhichiicihhiiiiihchccccchichci").matches(); // Compliant
|
||
|
|
----
|
||
|
|
|
||
|
|
include::../see.adoc[]
|