Regular Expression Injection¶

What does this mean ?¶

Regular expression injection occurs when untrusted text is interpreted as pattern syntax even though the application intended it as a literal value. The altered pattern can match unexpected input. Separately, a costly pattern or oversized input can cause excessive processing; this can happen even with a developer-written pattern.

What can happen ?¶

A search may return unintended results or a validation rule may be bypassed. Backtracking engines can spend excessive time on particular pattern/input combinations and reduce service availability. Other engines offer different complexity guarantees, so do not assume every regex implementation uses the same matching algorithm.

Recommendation¶

First decide whether the feature accepts literal text or an actual regular expression. For literal substring search, use the language's string search API. If a literal must be embedded in a larger trusted regex, use the engine's pattern-escaping function in the intended context. Pattern escaping is not the same as escaping a replacement string, and it changes a user-authored regex into literal text.

For an intentional regex feature, constrain pattern and input size, supported syntax and execution resources. Use a suitable engine with known complexity properties where possible. .NET supports explicit match timeouts; Python's standard re and JavaScript's standard RegExp do not provide the same per-match timeout API. An enforced isolated-worker deadline may be needed; merely timing a call without stopping its execution does not bound CPU use. A heuristic pattern analyzer is useful review assistance, not proof that a pattern is safe.

Sample Code¶

The feature below searches for a literal substring. Inputs are bounded to 4,096 language string units for the text and 1–128 for the needle. These are illustrative limits; byte, code-point and UTF-16 length measurements differ by language. Request-body limits must apply before large inputs are allocated.

The unsafe alternative is to compile the untrusted needle as a regex, such as new RegExp(needle).test(text) or re.search(needle, text).

def contains_literal(text: str, needle: str) -> bool:
    if not isinstance(text, str) or not isinstance(needle, str):
        raise ValueError("Text and needle must be strings")
    if len(text) > 4096 or not 1 <= len(needle) <= 128:
        raise ValueError("Search input outside limits")
    return needle in text

function containsLiteral(text, needle) {
  if (typeof text !== 'string' || typeof needle !== 'string' ||
      text.length > 4096 || needle.length < 1 || needle.length > 128) {
    throw new Error('Invalid search input');
  }
  return text.includes(needle);
}

static bool ContainsLiteral(string text, string needle)
{
    if (text is null || needle is null || text.Length > 4096 ||
        needle.Length < 1 || needle.Length > 128)
        throw new ArgumentException("Invalid search input");
    return text.IndexOf(needle, StringComparison.Ordinal) >= 0;
}

static boolean containsLiteral(String text, String needle) {
    if (text == null || needle == null || text.length() > 4096 ||
            needle.length() < 1 || needle.length() > 128) {
        throw new IllegalArgumentException("Invalid search input");
    }
    return text.contains(needle);
}

function containsLiteral(string $text, string $needle): bool {
    if (strlen($text) > 4096 || strlen($needle) < 1 || strlen($needle) > 128) {
        throw new InvalidArgumentException('Invalid search input');
    }
    return str_contains($text, $needle);
}

def contains_literal(text, needle)
  unless text.is_a?(String) && needle.is_a?(String) &&
         text.length <= 4096 && (1..128).cover?(needle.length)
    raise ArgumentError, 'Invalid search input'
  end
  text.include?(needle)
end

Regression checks¶

Test literal punctuation such as a.b, [name], *, parentheses and backslashes. a.b must not match acb unless that literal substring exists. Verify maximum lengths, empty needles and invalid types. For any intentional regex feature, run separate bounded local complexity tests under an enforced deadline; do not execute intentionally expensive patterns in a production request handler to test it.

References¶

• Python re and re.escape
• MDN String.includes
• Microsoft regex best practices and timeouts
• PHP preg_quote
• Ruby Regexp
• Related: code injection