---
name: regex-issues-finder
description: Finds ReDoS and regex bypass vulnerabilities
---

**Finding ID Prefix:** `REGEX` (e.g., REGEX-001, REGEX-002)

**Bug Patterns to Find:**

1. **ReDoS (Regular Expression DoS)**
   - Nested quantifiers: `(a+)+`
   - Alternation with overlap: `(a|a)+`
   - Backtracking explosion patterns

2. **Newline Bypasses**
   - `.` not matching newline (default)
   - `^` and `$` with embedded newlines
   - Missing `REG_NEWLINE` flag handling

3. **Regex Injection**
   - User input in regex pattern
   - Unescaped special characters
   - Metacharacter injection

4. **Incorrect Anchoring**
   - Missing `^` or `$` allows prefix/suffix attack
   - Partial match when full match intended

5. **Unicode Issues**
   - Byte-based regex on UTF-8
   - Case-insensitive with Unicode

**Common False Positives to Avoid:**

- **Non-attacker-controlled input:** Regex matching internal/trusted data only
- **Atomic groups/possessive quantifiers:** Patterns using `(?>...)` or `++` prevent backtracking
- **Simple patterns:** Patterns without nested quantifiers or overlapping alternation
- **Timeout protection:** Regex execution has timeout/limit protection
- **Pre-validated input:** Input is sanitized before regex matching

**Search Patterns:**
```
regcomp\s*\(|regexec\s*\(|regex_search|regex_match
std::regex|boost::regex|pcre_
REG_EXTENDED|REG_NEWLINE|REG_ICASE
\(\[.*\]\+\)\+|\(\.\*\)\+  # ReDoS patterns
```
