Regular expressions without a timeout can be exploited to cause a Denial-of-Service attack.
Why is this an issue?
When a regular expression is executed against untrusted input without a timeout, a malicious user may craft an input that triggers catastrophic
backtracking, where the regex engine takes exponential time to determine there is no match. This type of attack is known as a Regular Expression
Denial of Service (ReDoS). This rule raises an issue when System.Text.RegularExpressions APIs are called without a
matchTimeout parameter and no process-wide default timeout has been configured via
AppDomain.CurrentDomain.SetData("REGEX_DEFAULT_MATCH_TIMEOUT", timeout).
What is the potential impact?
An attacker who controls the input to a vulnerable regular expression can cause the application to consume all available CPU time while processing a single request, making the service unavailable to legitimate users.
How to fix it
Code examples
The following code is vulnerable because the regular expressions are executed without a timeout, allowing a crafted input to trigger catastrophic backtracking.
Noncompliant code example
Public Sub RegexPattern(Input As String)
Dim EmailPattern As New Regex(".+@.+", RegexOptions.None)
Dim IsNumber as Boolean = Regex.IsMatch(Input, "[0-9]+")
Dim IsLetterA as Boolean = Regex.IsMatch(Input, "(a+)+")
' Noncompliant: missing timeout
End Sub
Compliant solution
Public Sub RegexPattern(Input As String)
Dim EmailPattern As New Regex(".+@.+", RegexOptions.None, TimeSpan.FromMilliseconds(100))
Dim IsNumber as Boolean = Regex.IsMatch(Input, "[0-9]+", RegexOptions.None, TimeSpan.FromMilliseconds(100))
Dim IsLetterA As Boolean = Regex.IsMatch(Input, "(a+)+", RegexOptions.NonBacktracking) '.NET 7 And above
AppDomain.CurrentDomain.SetData("REGEX_DEFAULT_MATCH_TIMEOUT", TimeSpan.FromMilliseconds(100)) 'process-wide setting
End Sub
Resources
Documentation
- Best practices for regular expressions in .NET
- Backtracking in Regular Expressions
- Regex.MatchTimeout Property
- RegexOptions Enum - NonBacktracking option
Articles & blog posts
- regular-expressions.info - Runaway Regular Expressions: Catastrophic Backtracking
- owasp.org - Regular expression Denial of Service - ReDoS
- devblogs.microsoft.com - Regular Expression Improvements in .NET 7: Backtracking and RegexOptions.NonBacktracking