Total ReDoS: the Dangers of Regex in JavaScript
summary
Regular expressions can cause ReDoS where simple patterns explode into massive work: a whitespace-trimming pattern runs into 200 million steps when faced with 20,000 spaces and causes a 34-minute outage on Stack Overflow; a dot-star-dot pattern triggers 27 minute outage at Cloudflare; node-fetch’s localhost check produces exponential backtracking. Fixes include limiting input length, using built-in trim, refactoring overlaps (e.g. [^.] instead of .), using lookaround/fake-atomic tricks, switching to RE2, and scanning with tools like recheck and eslint-plugin-redos, regex101, Regexper and the Rex debugger.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:01Why regex dangers
- 3:27Backtrack overflow
- 9:26Fixing backtrack overflow
- 13:17Catastrophic backtracking
- 23:12Email regex pitfalls
- 28:12Refactoring nested qualifiers
- 33:07Avoiding regex entirely
- 34:31Alternative regex engines
- 35:13Tools to detect redos
- 36:59Summary and tools
related talks
43mTotal ReDoS: the dangers of regex in JavaScript
26mTotal ReDoS: The Dangers of regex in JavaScript
31mOh no! My regex is causing a Denial of Service! What can I do about it?
31mService Denied! Understanding How Regex DoS Attacks Work
21mFreezing the Web: A Study of ReDoS Vulnerabilities in JavaScript-based Web Servers
26mAll Aboard the Regular Express
01h 13m/ Reg (exp) {2} lained / Demystifying Regular Expressions
01h 37mTime to Use Regular Expressions More, Um, Regularly