Regex Security and ReDoS Risk Patterns
A conservative guide to recognising expensive regular-expression structures and validating them in context.
What ReDoS means
Regular-expression denial of service occurs when an engine explores a rapidly growing number of matching paths for crafted input. Backtracking engines are especially sensitive to ambiguous alternatives and nested repetition.
Patterns worth reviewing
Nested quantifiers, overlapping alternatives inside repetition and broad wildcards followed by a required suffix can deserve scrutiny. A warning is a review signal, not proof that an expression is exploitable.
Review: (a+)+$
Review: (a|aa)+$
Prefer bounded, unambiguous structure where possible.Test safely
Use bounded input sizes and representative near-miss cases. Apply timeouts at the application boundary, avoid running untrusted expressions with unbounded text, and prefer a non-backtracking engine where the language and feature requirements allow it.
KaseShift’s scanner detects selected structural warning signs. It cannot guarantee safety or replace profiling and security review in the target runtime.