SafeRegex

SafeRegex is a tool that tests regular expressions for ReDoS vulnerabilities. In contrast to similar tools, SafeRegex doesn't use plain fuzzing to detect vulnerabilites but uses an approach similar to model checking. This makes it much more effective than plain fuzzers.

Usage

Build the executable JAR:

$ ./mvnw clean package

Run the JAR against an evil regex:

$ java -jar target/saferegex.jar "(a|aa)+"

Testing: (a|aa)+
More than 10000 samples found.
***
This expression is vulnerable.
Sample input: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaab

Or a safe regex:

$ java -jar target/saferegex.jar "(ht|f)tp(s?)\:\/\/[0-9a-zA-Z]([-.a-zA-Z_]*[0-9a-zA-Z])*(:(0-9)*)?(\/?)([a-zA-Z0-9\-\.\?\,\:\'\/\\\+=&%\$#_]*)?"

Testing: (ht|f)tp(s?)\:\/\/[0-9a-zA-Z]([-.a-zA-Z_]*[0-9a-zA-Z])*(:(0-9)*)?(\/?)([a-zA-Z0-9\-\.\?\,\:\'\/\\\+=&%\$#_]*)?
More than 10000 samples found.
************************************************************************************************************************************************************************************************************
*****************************************************************************************************************************
Tests: 3297
Broken samples: 0
This expression is probably not vulnerable for sample sizes < 10000

Usage as a dependency

<dependency>
    <groupId>com.github.jkutner</groupId>
    <artifactId>saferegex</artifactId>
</dependency>

History

The project was created on Feb 16, 2011 by Sebastian Kübeck and hosted on Google Code. This project has been forked from the original and now maintained by Joe Kutner.

License

Apache License, Version 2.0