redosray 1.0.0 → 1.1.0

package/README.md

@@ -1,5 +1,10 @@
 # redosray
 
+[![CI](https://github.com/aurelio-nakamura/redosray/actions/workflows/ci.yml/badge.svg)](https://github.com/aurelio-nakamura/redosray/actions/workflows/ci.yml)
+[![npm](https://img.shields.io/npm/v/redosray.svg)](https://www.npmjs.com/package/redosray)
+[![node](https://img.shields.io/node/v/redosray.svg)](https://www.npmjs.com/package/redosray)
+[![license](https://img.shields.io/npm/l/redosray.svg)](./LICENSE)
+
 **Find ReDoS-vulnerable regexes in your code — and *prove* each one, offline.**
 
 redosray scans your JavaScript / TypeScript / Python for [regular-expression
@@ -98,13 +103,43 @@ echo '(x+x+)+y' | redosray -e -    # from stdin
 
 ### Use it in CI
 
-Fail the build if a ReDoS regex sneaks in:
+Fail the build if a ReDoS regex sneaks in.
+
+**GitHub Actions** — drop in the action:
 
 ```yaml
 # .github/workflows/redos.yml
+name: ReDoS
+on: [push, pull_request]
+jobs:
+  redosray:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: aurelio-nakamura/redosray@v1
+        with:
+          paths: src/          # optional (default: whole repo)
+          timeout: '1000'      # optional, ms per match
+          # fail-on-vuln: false  # report without failing the build
+```
+
+Or just run the CLI directly in any CI:
+
+```yaml
 - run: npx redosray --ci src/
 ```
 
+**pre-commit** — catch it before it's even committed:
+
+```yaml
+# .pre-commit-config.yaml
+repos:
+  - repo: https://github.com/aurelio-nakamura/redosray
+    rev: v1.0.0
+    hooks:
+      - id: redosray
+```
+
 ### JSON for tooling
 
 ```bash

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "redosray",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "Find ReDoS-vulnerable regexes in your code and prove them — offline. Shows the exact input that hangs each pattern.",
   "type": "commonjs",
   "repository": {
@@ -23,7 +23,7 @@
     "LICENSE"
   ],
   "scripts": {
-    "test": "node --test test/**/*.test.js",
+    "test": "node --test --test-concurrency=1 test/*.test.js",
     "start": "node bin/redosray.js",
     "build:browser": "node scripts/build-browser.js"
   },

package/src/analyze.js

@@ -37,14 +37,17 @@ function walk(node, visit) {
   }
 }
 
-// Find, inside `node`, a descendant unbounded repeat over an atom-ish body.
-function findInnerRepeat(node) {
-  let found = null;
+// Find, inside `node`, ALL descendant unbounded repeats over an atom-ish body.
+// (We can't know statically which inner loop drives the blow-up — e.g. in
+// `(([_]+)?([a-z0-9]+))*` the exploitable overlap is on `[a-z0-9]+`, not the
+// first-encountered `[_]+` — so we return every candidate and let dynamic
+// confirmation pick the real one. Extra candidates only cost a probe run.)
+function findInnerRepeats(node) {
+  const found = [];
   walk(node, (n) => {
-    if (found) return;
     if (isUnbounded(n)) {
       const b = unwrap(n.body);
-      if (['char', 'class', 'any', 'esc'].includes(b.type)) found = { rep: n, atom: b };
+      if (['char', 'class', 'any', 'esc'].includes(b.type)) found.push({ rep: n, atom: b });
     }
   });
   return found;
@@ -61,6 +64,76 @@ function makeAttack(kind, matchedShape, pump, suffix, prefix = '') {
   return { kind, matchedShape, prefix, pump, suffix };
 }
 
+// A minimal concrete string that `node` can match (a "witness"). Used to build
+// the prefix that lets the engine actually REACH a vulnerable loop buried in
+// the middle of a pattern (e.g. the `<` and `[a-z]+` before `([^>]*)*`).
+function witness(node) {
+  switch (node.type) {
+    case 'char': return node.value;
+    case 'any': return 'a';
+    case 'esc': {
+      const k = node.kind;
+      if (k === 'd') return '0';
+      if (k === 'D') return 'a';
+      if (k === 'w') return 'a';
+      if (k === 'W') return '!';
+      if (k === 's') return ' ';
+      if (k === 'S') return 'a';
+      if (k === 'b' || k === 'B') return '';
+      return '';
+    }
+    case 'class': return sampleChar(node) || 'a';
+    case 'anchor': case 'look': return '';
+    case 'backref': return '';
+    case 'group': return witness(node.body);
+    case 'alt': {
+      for (const o of node.options) { const w = witness(o); if (w !== '') return w; }
+      return witness(node.options[0]);
+    }
+    case 'seq': return node.items.map(witness).join('');
+    case 'repeat': {
+      const body = witness(node.body);
+      return body.repeat(Math.max(0, node.min));
+    }
+    default: return '';
+  }
+}
+
+// Build a concrete string matching everything strictly BEFORE `target` in the
+// pattern, so the engine reaches the vulnerable loop. Returns { found, prefix }.
+function reachingPrefix(node, target) {
+  if (node === target) return { found: true, prefix: '' };
+  switch (node.type) {
+    case 'seq': {
+      let acc = '';
+      for (const it of node.items) {
+        const r = reachingPrefix(it, target);
+        if (r.found) return { found: true, prefix: acc + r.prefix };
+        acc += witness(it);
+      }
+      return { found: false, prefix: acc };
+    }
+    case 'group': {
+      const r = reachingPrefix(node.body, target);
+      return r.found ? { found: true, prefix: r.prefix } : { found: false, prefix: witness(node) };
+    }
+    case 'repeat': {
+      const r = reachingPrefix(node.body, target);
+      // entering the loop body once is enough to reach a target inside it
+      return r.found ? { found: true, prefix: r.prefix } : { found: false, prefix: witness(node) };
+    }
+    case 'alt': {
+      for (const o of node.options) {
+        const r = reachingPrefix(o, target);
+        if (r.found) return { found: true, prefix: r.prefix };
+      }
+      return { found: false, prefix: witness(node) };
+    }
+    default:
+      return { found: false, prefix: witness(node) };
+  }
+}
+
 // Produce a stable-ish shape string for dedup/reporting.
 function shapeOf(node) {
   switch (node.type) {
@@ -100,17 +173,31 @@ function findCandidates(source) {
     out.push(c);
   };
 
+  // Suffixes to try after the pumped run. We over-generate: the true failing
+  // suffix might be a char the loop can't eat (forces `$`/next-token to fail),
+  // OR simply END-OF-STRING (empty) when a required trailing literal follows
+  // the loop (e.g. the final `>` in `<([a-z]+)([^>]*)*>`). Dynamic confirmation
+  // picks whichever actually hangs, so extra options only cost a probe run.
+  const suffixSet = (atom) => {
+    const s = new Set();
+    s.add(failChar(atom));
+    s.add('');
+    s.add('\uffff');
+    return [...s];
+  };
+
   walk(ast, (node) => {
     // ---- Family A: nested quantifier  (X+)+ , (X*)* , ((\d+))+ ...
     if (isUnbounded(node)) {
-      const inner = findInnerRepeat(node.body);
-      if (inner) {
+      const pfx = reachingPrefix(ast, node).prefix;
+      for (const inner of findInnerRepeats(node.body)) {
         const pump = sampleChar(inner.atom);
         // Require the outer body to also start with pump, so consecutive outer
         // iterations overlap (this is what makes it ambiguous / exponential).
         if (pump && canStart(node.body, pump)) {
-          const suffix = failChar(inner.atom);
-          push(makeAttack('nested-quantifier', shapeOf(node), pump, suffix));
+          for (const suffix of suffixSet(inner.atom)) {
+            push(makeAttack('nested-quantifier', shapeOf(node), pump, suffix, pfx));
+          }
         }
       }
 
@@ -121,8 +208,9 @@ function findCandidates(source) {
           for (let y = x + 1; y < opts.length; y++) {
             const pump = overlapChar(opts[x], opts[y]);
             if (pump) {
-              const suffix = failChar(node.body);
-              push(makeAttack('ambiguous-alternation', shapeOf(node), pump, suffix));
+              for (const suffix of suffixSet(node.body)) {
+                push(makeAttack('ambiguous-alternation', shapeOf(node), pump, suffix, pfx));
+              }
             }
           }
         }
@@ -148,9 +236,11 @@ function findCandidates(source) {
           if (!between) continue;
           const pump = overlapChar(reps[a].rep.body, reps[b].rep.body);
           if (pump) {
-            const suffix = failChar(reps[a].rep.body);
+            const pfx = reachingPrefix(ast, node.items[reps[a].idx]).prefix;
             const shape = shapeOf({ type: 'seq', items: node.items.slice(reps[a].idx, reps[b].idx + 1) });
-            push(makeAttack('sequential-quantifier', shape, pump, suffix));
+            for (const suffix of suffixSet(reps[a].rep.body)) {
+              push(makeAttack('sequential-quantifier', shape, pump, suffix, pfx));
+            }
           }
         }
       }