Contents
V5327. OWASP. Possible regex injection. Potentially tainted data is used to create regular expression
The analyzer has detected that external data is used to create regular expressions without verification. This exposes the application to the risk of a Denial of Service (DoS) attack.
This vulnerability can be categorized under the OWASP Top 10 2021 classification as follows:
If the code looks like this:
@GetMapping("/check")
public String checkInput(@RequestParam("input") String input) {
var match = vulnerableString.matches(input); // <=
if (match) {
return "Valid input";
} else {
return "Invalid input";
}
}Attackers can create an inefficient regular expression that degrades the application performance. In the worst case, if attackers can exploit an Evil Regex—a regular expression that causes execution to hang—it will result in DoS. Such an attack is called ReDoS.
To harden security, escape an output using Pattern.quote:
@GetMapping("/check")
public String checkInput(@RequestParam("input") String input) {
var regex = Pattern.quote(input);
var match = vulnerableString.matches(input);
if (match) {
return "Valid input";
} else {
return "Invalid input";
}
}Was this page helpful?
