regular-expression-dos.yaml

rules:
- id: regular-expression-dos
  severity: WARNING
  languages:
  - C#
  metadata:
    cwe:
    - 'CWE-1333: Inefficient Regular Expression Complexity'
    owasp: 'A01:2017 - Injection'
    references:
    - https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS
    - https://docs.microsoft.com/en-us/dotnet/standard/base-types/regular-expressions#regular-expression-examples
    category: security
    technology:
    - .net
    confidence: MEDIUM
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
  message: >-
    When using `System.Text.RegularExpressions` to process untrusted input, pass a timeout. 
    A malicious user can provide input to `RegularExpressions` that abuses the backtracking behaviour of this regular expression engine.
    This will lead to excessive CPU usage, causing a Denial-of-Service attack
  patterns:
  - pattern-inside: |
      using System.Text.RegularExpressions;
      ...
  - pattern-either:
    - pattern: |
        public $T $F($X)
        {
          Regex $Y = new Regex($P);
          ...
          $Y.Match($X);
        }
    - pattern: |
        public $T $F($X)
        {
          Regex $Y = new Regex($P, $O);
          ...
          $Y.Match($X);
        }
    - pattern: |
        public $T $F($X)
        {
          ... Regex.Match($X, $P);
        }
    - pattern: |
        public $T $F($X)
        {
          ... Regex.Match($X, $P, $O);
        }