Regular expression without a match timeout (ReDoS)

ID

vbnet.inject.redos

Severity

high

Remediation Complexity

medium

Remediation Risk

low

Remediation Effort

low

Resource

Inject

Language

VB.NET

Description

Regular expression evaluated without a match timeout. A catastrophically backtracking pattern applied to attacker-controlled input can hang the thread and cause a denial of service (ReDoS). Pass a matchTimeout (a TimeSpan, e.g. TimeSpan.FromSeconds(2)) to the Regex constructor or the static Regex methods.

Rationale

Regular expression evaluated without a match timeout. A catastrophically backtracking pattern applied to attacker-controlled input can hang the thread and cause a denial of service (ReDoS). Pass a matchTimeout (a TimeSpan, e.g. TimeSpan.FromSeconds(2)) to the Regex constructor or the static Regex methods.

The following code illustrates a vulnerable pattern detected by this rule:

Public Sub NewRegexNoTimeout(ByVal pattern As String)
    ' VULNERABLE: Regular expression without a match timeout (ReDoS)
    Dim re As New Regex(pattern)
End Sub

Remediation

Follow secure coding practices and review the references below for detailed remediation guidance.

Configuration

This detector does not need any configuration.

References