FlashRegex

Li, Yeting; Xu, Zhiwu; Cao, Jialun; Chen, Haiming; Ge, Tingjian; Cheung, Shing-Chi; Zhao, Haoren

doi:10.1145/3324884.3416556

Cited by 18 publications

(3 citation statements)

References 52 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Michael et al reported that many software engineers find regex engineering difficult [79]. To assist the engineering community in this domain, researchers have recently described regex engineering practices related to composition [20], comprehension [33], and testing [109]; identified common regex bug patterns and taxonomies [56,70,108]; and proposed tools to support regex comprehension [26], testing [69,98], and repair [76,86]. There has also been a longstanding effort to automatically compose regexes, with diverse approaches including formal methods [16,17,35,51,63,75], evolutionary algorithms [22,23,37], optimization [74,91], crowdsourcing [36], natural-language translation [34], and human-in-theloop interactive development [54,115].…”

Section: Related Workmentioning

confidence: 99%

Exploiting input sanitization for regex denial of service

Barlas

Davis

2022

Proceedings of the 44th International Conference on Software Engineering

View full text Add to dashboard Cite

Web services use server-side input sanitization to guard against harmful input. Some web services publish their sanitization logic to make their client interface more usable, e.g., allowing clients to debug invalid requests locally. However, this usability practice poses a security risk. Specifically, services may share the regexes they use to sanitize input strings -and regex-based denial of service (ReDoS) is an emerging threat. Although prominent service outages caused by ReDoS have spurred interest in this topic, we know little about the degree to which live web services are vulnerable to ReDoS.In this paper, we conduct the first black-box study measuring the extent of ReDoS vulnerabilities in live web services. We apply the Consistent Sanitization Assumption: that client-side sanitization logic, including regexes, is consistent with the sanitization logic on the server-side. We identify a service's regex-based input sanitization in its HTML forms or its API, find vulnerable regexes among these regexes, craft ReDoS probes, and pinpoint vulnerabilities. We analyzed the HTML forms of 1,000 services and the APIs of 475 services. Of these, 355 services publish regexes; 17 services publish unsafe regexes; and 6 services are vulnerable to ReDoS through their APIs (6 domains; 15 subdomains). Both Microsoft and Amazon Web Services patched their web services as a result of our disclosure. Since these vulnerabilities were from API specifications, not HTML forms, we proposed a ReDoS defense for a popular API validation library, and our patch has been merged. To summarize: in client-visible sanitization logic, some web services advertise Re-DoS vulnerabilities in plain sight. Our results motivate short-term patches and long-term fundamental solutions."Make measurable what cannot be measured. " -Galileo Galilei CCS CONCEPTS• Security and privacy → Denial-of-service attacks; Web application security; • General and reference → Empirical studies; Measurement; Validation.

show abstract

Section: Related Workmentioning

confidence: 99%

Exploiting input sanitization for regex denial of service

Barlas

Davis

2022

Proceedings of the 44th International Conference on Software Engineering

View full text Add to dashboard Cite

show abstract

“…Pan et al [85] repaired regular expressions with both positive and negative examples, and it guaranteed to find the syntactically smallest repair of the original regular expression. Here, "smallest" is measured by the edit distance between the abstract syntax trees of the initial regular expression and the target regular expression.…”

Section: Repairingmentioning

confidence: 99%

“…To view a copy of this licence, visit http://creativecommons.org/licenses/by/4.0/. Testing status [14] RE coverage based [33] From positive examples [52] Syntax check [10] Highlight [72−74] Based on positive examples [83] Bug classification [22] DFA coverage based [11] From both examples [53−57] Semantic check [68−70] Automaton graph [75−79] Based on negative examples [84] Feature usage [8] Mutation based [49] Gold′s learning [59−61] Verification [71] Tree view [74,80] Based on both examples [85] Evolution [24] Sampling [40,41] From specifications [62−64] Visual IDE [81] Based on genetic programming [88,89] Comprehension [23] Enumerating [91] From specifications and examples [66] Visual structure [82] Interactive repair [90] Composition [25] Random [45,47] Abstraction [12] Repair vulnerable [86,87] Portability [28] Systematic [46−48] Development cycle [30] Determinism [32] Readability [92]…”

Section: Open Accessmentioning

confidence: 99%

Ensuring the Correctness of Regular Expressions: A Review

Zheng

Chen

et al. 2021

Int. J. Autom. Comput.

View full text Add to dashboard Cite

Regular expressions are widely used within and even outside of computer science due to their expressiveness and flexibility. However, regular expressions have a quite compact and rather tolerant syntax that makes them hard to understand, hard to compose, and error-prone. Faulty regular expressions may cause failures of the applications that use them. Therefore, ensuring the correctness of regular expressions is a vital prerequisite for their use in practical applications. The importance and necessity of ensuring correct definitions of regular expressions have attracted extensive attention from researchers and practitioners, especially in recent years. In this study, we provide a review of the recent works for ensuring the correct usage of regular expressions. We classify those works into different categories, including the empirical study, test string generation, automatic synthesis and learning, static checking and verification, visual representation and explanation, and repairing. For each category, we review the main results, compare different approaches, and discuss their advantages and disadvantages. We also discuss some potential future research directions.

show abstract

Sound Static Analysis of Regular Expressions for Vulnerabilities to Denial of Service Attacks

Parolini

Miné

2022

Theoretical Aspects of Software Engineering

View full text Add to dashboard Cite

Modern programming languages often provide functions to manipulate regular expressions in standard libraries. If they offer support for advanced features, the matching algorithm has an exponential worstcase time complexity: for some so-called vulnerable regular expressions, an attacker can craft ad hoc strings to force the matcher to exhibit an exponential behaviour and perform a Regular Expression Denial of Service (ReDoS) attack. In this paper, we introduce a framework based on a tree semantics to statically identify ReDoS vulnerabilities. In particular, we put forward an algorithm to extract an overapproximation of the set of words that are dangerous for a regular expression, effectively catching all possible attacks. We have implemented the analysis in a tool called rat, and testing it on a dataset of 74,670 regular expressions, we observed that in 99.47% of the instances the analysis terminates in less than one second. We compared rat to four other ReDoS detectors, and we found that our tool is faster, often by orders of magnitude, than most other tools. While raising a low number of false positives, rat is the only ReDoS detector that does not report false negatives.

show abstract

FlashRegex

Cited by 18 publications

References 52 publications

Exploiting input sanitization for regex denial of service

Exploiting input sanitization for regex denial of service

Ensuring the Correctness of Regular Expressions: A Review

Sound Static Analysis of Regular Expressions for Vulnerabilities to Denial of Service Attacks

Contact Info

Product

Resources

About