redosray 1.0.0

package/src/parser.js

@@ -0,0 +1,172 @@
+'use strict';
+// A small, dependency-free parser for JavaScript-flavoured regular expressions.
+// It produces an AST that the analyzer walks to find catastrophic-backtracking
+// shapes. It intentionally covers the constructs that matter for ReDoS
+// (groups, alternation, quantifiers, char classes, anchors, lookaround) and
+// degrades gracefully on anything exotic by throwing, so the caller can fall
+// back to "unknown" rather than emit a wrong result.
+//
+// AST node shapes:
+//   { type: 'alt',    options: Node[] }              a|b|c
+//   { type: 'seq',    items: Node[] }                abc
+//   { type: 'repeat', min, max, greedy, body: Node } a*  a+  a?  a{2,5}
+//   { type: 'group',  capturing, name, body: Node }  (a) (?:a) (?<x>a)
+//   { type: 'look',   negative, behind, body: Node } (?=a) (?!a) (?<=a) (?<!a)
+//   { type: 'char',   value: string }                literal char
+//   { type: 'class',  negated, set: string }         [a-z]  (set is raw body)
+//   { type: 'any' }                                  .
+//   { type: 'anchor', kind: string }                 ^ $ \b \B
+//   { type: 'esc',    kind: string }                 \d \w \s \D \W \S
+//   { type: 'backref',ref: string }                  \1  \k<name>
+
+function parse(source) {
+  let i = 0;
+  const n = source.length;
+
+  function peek() { return source[i]; }
+  function eof() { return i >= n; }
+
+  function parseAlternation() {
+    const options = [parseSequence()];
+    while (!eof() && peek() === '|') {
+      i++; // consume |
+      options.push(parseSequence());
+    }
+    return options.length === 1 ? options[0] : { type: 'alt', options };
+  }
+
+  function parseSequence() {
+    const items = [];
+    while (!eof() && peek() !== '|' && peek() !== ')') {
+      items.push(parseQuantified());
+    }
+    if (items.length === 1) return items[0];
+    return { type: 'seq', items };
+  }
+
+  function parseQuantified() {
+    const atom = parseAtom();
+    if (eof()) return atom;
+    const c = peek();
+    let min, max;
+    if (c === '*') { min = 0; max = Infinity; i++; }
+    else if (c === '+') { min = 1; max = Infinity; i++; }
+    else if (c === '?') { min = 0; max = 1; i++; }
+    else if (c === '{') {
+      const saved = i;
+      const q = tryParseBrace();
+      if (!q) return atom; // literal '{'
+      min = q.min; max = q.max;
+    } else {
+      return atom;
+    }
+    let greedy = true;
+    if (!eof() && peek() === '?') { greedy = false; i++; }
+    else if (!eof() && peek() === '+') { greedy = true; i++; } // possessive-ish; treat greedy
+    return { type: 'repeat', min, max, greedy, body: atom };
+  }
+
+  function tryParseBrace() {
+    // i points at '{'
+    const start = i;
+    const m = /^\{(\d+)(,(\d*)?)?\}/.exec(source.slice(i));
+    if (!m) return null;
+    i += m[0].length;
+    const min = parseInt(m[1], 10);
+    let max;
+    if (m[2] === undefined) max = min;         // {n}
+    else if (m[3] === '' || m[3] === undefined) max = Infinity; // {n,}
+    else max = parseInt(m[3], 10);             // {n,m}
+    return { min, max };
+  }
+
+  function parseAtom() {
+    const c = peek();
+    if (c === '(') return parseGroup();
+    if (c === '[') return parseClass();
+    if (c === '^' || c === '$') { i++; return { type: 'anchor', kind: c }; }
+    if (c === '.') { i++; return { type: 'any' }; }
+    if (c === '\\') return parseEscape();
+    if (c === '*' || c === '+' || c === '?') {
+      // dangling quantifier — treat as literal to be forgiving
+      i++; return { type: 'char', value: c };
+    }
+    i++;
+    return { type: 'char', value: c };
+  }
+
+  function parseGroup() {
+    i++; // consume (
+    let capturing = true;
+    let name = null;
+    let look = null;
+    if (peek() === '?') {
+      i++;
+      const k = peek();
+      if (k === ':') { i++; capturing = false; }
+      else if (k === '=') { i++; look = { negative: false, behind: false }; }
+      else if (k === '!') { i++; look = { negative: true, behind: false }; }
+      else if (k === '<') {
+        i++;
+        const k2 = peek();
+        if (k2 === '=') { i++; look = { negative: false, behind: true }; }
+        else if (k2 === '!') { i++; look = { negative: true, behind: true }; }
+        else {
+          // named group (?<name>...)
+          let nm = '';
+          while (!eof() && peek() !== '>') { nm += source[i++]; }
+          if (peek() === '>') i++;
+          name = nm; capturing = true;
+        }
+      } else {
+        // unknown group flag (e.g. (?i)) — skip until ) conservatively
+        capturing = false;
+      }
+    }
+    const body = parseAlternation();
+    if (peek() === ')') i++;
+    else throw new Error('unbalanced group');
+    if (look) return { type: 'look', negative: look.negative, behind: look.behind, body };
+    return { type: 'group', capturing, name, body };
+  }
+
+  function parseClass() {
+    i++; // consume [
+    let negated = false;
+    if (peek() === '^') { negated = true; i++; }
+    let raw = '';
+    // a ] immediately after [ or [^ is a literal
+    if (peek() === ']') { raw += ']'; i++; }
+    while (!eof() && peek() !== ']') {
+      if (peek() === '\\') { raw += source[i++]; if (!eof()) raw += source[i++]; }
+      else raw += source[i++];
+    }
+    if (peek() === ']') i++;
+    else throw new Error('unterminated character class');
+    return { type: 'class', negated, set: raw };
+  }
+
+  function parseEscape() {
+    i++; // consume backslash
+    if (eof()) return { type: 'char', value: '\\' };
+    const c = source[i++];
+    if ('dwsDWS'.includes(c)) return { type: 'esc', kind: c };
+    if (c === 'b' || c === 'B') return { type: 'anchor', kind: '\\' + c };
+    if (/[0-9]/.test(c)) return { type: 'backref', ref: c };
+    if (c === 'k') {
+      // \k<name>
+      let nm = '';
+      if (peek() === '<') { i++; while (!eof() && peek() !== '>') nm += source[i++]; if (peek() === '>') i++; }
+      return { type: 'backref', ref: nm };
+    }
+    const map = { n: '\n', r: '\r', t: '\t', f: '\f', v: '\v', '0': '\0' };
+    if (c in map) return { type: 'char', value: map[c] };
+    return { type: 'char', value: c };
+  }
+
+  const ast = parseAlternation();
+  if (!eof()) throw new Error('unexpected trailing input at ' + i);
+  return ast;
+}
+
+module.exports = { parse };

package/src/scan.js

@@ -0,0 +1,53 @@
+'use strict';
+const { findCandidates } = require('./analyze');
+const { confirm } = require('./confirm');
+
+const CLASS_BY_KIND = {
+  'nested-quantifier': 'exponential',
+  'ambiguous-alternation': 'exponential',
+  'sequential-quantifier': 'polynomial',
+};
+
+/**
+ * Statically find candidate ReDoS shapes in a regex, then DYNAMICALLY confirm
+ * each by measuring a real hang in an isolated worker. Returns the first
+ * confirmed vulnerability (with a shareable proof), or a not-vulnerable result.
+ *
+ * @param {string} source  regex source (no slashes)
+ * @param {string} flags   regex flags (e.g. 'i')
+ * @param {object} opts    { timeoutMs, maxPumps }
+ */
+async function scanRegex(source, flags = '', opts = {}) {
+  const candidates = findCandidates(source);
+  if (candidates.length === 0) {
+    return { source, flags, vulnerable: false, candidates: 0, checked: 0 };
+  }
+  // Exponential candidates need only a few pumps; polynomial needs more.
+  let checked = 0;
+  for (const attack of candidates) {
+    const isPoly = CLASS_BY_KIND[attack.kind] === 'polynomial';
+    const runOpts = {
+      timeoutMs: opts.timeoutMs ?? 1000,
+      maxPumps: opts.maxPumps ?? (isPoly ? 100000 : 5000),
+    };
+    checked++;
+    const res = await confirm(source, flags, attack, runOpts);
+    if (res.vulnerable) {
+      return {
+        source,
+        flags,
+        vulnerable: true,
+        kind: attack.kind,
+        complexity: CLASS_BY_KIND[attack.kind] || 'unknown',
+        matchedShape: attack.matchedShape,
+        proof: res.proof,
+        samples: res.samples,
+        candidates: candidates.length,
+        checked,
+      };
+    }
+  }
+  return { source, flags, vulnerable: false, candidates: candidates.length, checked };
+}
+
+module.exports = { scanRegex };

package/src/scanFiles.js

@@ -0,0 +1,134 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { extractFromText, languageForPath } = require('./extract');
+const { scanRegex } = require('./scan');
+
+const DEFAULT_IGNORE = new Set([
+  'node_modules', '.git', 'dist', 'build', 'out', 'coverage',
+  '.next', '.nuxt', '.venv', 'venv', '__pycache__', 'vendor',
+  '.cache', 'target', '.svelte-kit',
+]);
+
+function isScannable(p) {
+  return languageForPath(p) !== null;
+}
+
+/**
+ * Recursively collect scannable source files under a set of roots.
+ */
+function collectFiles(roots, { ignore = DEFAULT_IGNORE, maxBytes = 2_000_000 } = {}) {
+  const files = [];
+  const seen = new Set();
+  const stack = Array.isArray(roots) ? [...roots] : [roots];
+  while (stack.length) {
+    const cur = stack.pop();
+    let st;
+    try { st = fs.statSync(cur); } catch { continue; }
+    if (st.isDirectory()) {
+      const base = path.basename(cur);
+      if (ignore.has(base)) continue;
+      let entries;
+      try { entries = fs.readdirSync(cur); } catch { continue; }
+      for (const e of entries) stack.push(path.join(cur, e));
+    } else if (st.isFile()) {
+      if (!isScannable(cur)) continue;
+      if (st.size > maxBytes) continue;
+      const real = fs.realpathSync(cur);
+      if (seen.has(real)) continue;
+      seen.add(real);
+      files.push(cur);
+    }
+  }
+  files.sort();
+  return files;
+}
+
+/**
+ * Deduplicate regex literals by (source+flags) so we confirm each distinct
+ * pattern only once (dynamic confirmation is the expensive step), while still
+ * reporting every location the pattern appears.
+ */
+function dedupeRegexes(perFile) {
+  const map = new Map();
+  for (const { file, regexes } of perFile) {
+    for (const r of regexes) {
+      const key = r.source + '\u0000' + r.flags;
+      if (!map.has(key)) map.set(key, { source: r.source, flags: r.flags, locations: [] });
+      map.get(key).locations.push({ file, line: r.line, column: r.column, raw: r.raw, kind: r.kind });
+    }
+  }
+  return [...map.values()];
+}
+
+/**
+ * Scan one or more files/directories for ReDoS-vulnerable regexes, confirming
+ * each dynamically. Returns a structured report.
+ *
+ * @param {string|string[]} roots  file or directory paths
+ * @param {object} opts { timeoutMs, ignore, onProgress }
+ */
+async function scanPaths(roots, opts = {}) {
+  const files = collectFiles(roots, opts);
+  const perFile = [];
+  for (const file of files) {
+    let text;
+    try { text = fs.readFileSync(file, 'utf8'); } catch { continue; }
+    // skip minified files: huge single lines yield garbage extractions
+    if (isLikelyMinified(text)) continue;
+    const regexes = extractFromText(text, file);
+    if (regexes.length) perFile.push({ file, regexes });
+  }
+
+  const distinct = dedupeRegexes(perFile);
+  const findings = [];
+  let confirmed = 0;
+  let idx = 0;
+  for (const d of distinct) {
+    idx++;
+    if (opts.onProgress) opts.onProgress({ index: idx, total: distinct.length, source: d.source });
+    let res;
+    try {
+      res = await scanRegex(d.source, d.flags, { timeoutMs: opts.timeoutMs ?? 1000 });
+    } catch (e) {
+      continue; // invalid regex source we couldn't compile; skip silently
+    }
+    if (res.vulnerable) {
+      confirmed++;
+      findings.push({
+        source: d.source,
+        flags: d.flags,
+        complexity: res.complexity,
+        kind: res.kind,
+        matchedShape: res.matchedShape,
+        proof: res.proof,
+        samples: res.samples,
+        locations: d.locations,
+      });
+    }
+  }
+
+  // Order findings: exponential first, then by number of locations.
+  findings.sort((a, b) => {
+    if (a.complexity !== b.complexity) return a.complexity === 'exponential' ? -1 : 1;
+    return b.locations.length - a.locations.length;
+  });
+
+  return {
+    filesScanned: files.length,
+    filesWithRegex: perFile.length,
+    distinctRegexes: distinct.length,
+    vulnerable: confirmed,
+    findings,
+  };
+}
+
+function isLikelyMinified(text) {
+  if (text.length < 5000) return false;
+  const lines = text.split('\n');
+  const avg = text.length / lines.length;
+  return avg > 2000;
+}
+
+module.exports = { scanPaths, collectFiles, DEFAULT_IGNORE };

package/src/worker.js

@@ -0,0 +1,11 @@
+'use strict';
+// Runs a single regex match in isolation so the parent can time it and
+// terminate it if it hangs (catastrophic backtracking cannot be interrupted
+// cooperatively, so isolation in a worker is the only safe way to measure it).
+const { parentPort, workerData } = require('node:worker_threads');
+const { source, flags, input } = workerData;
+const re = new RegExp(source, flags);
+const t0 = process.hrtime.bigint();
+const matched = re.test(input);
+const t1 = process.hrtime.bigint();
+parentPort.postMessage({ matched, ns: Number(t1 - t0) });