saferegex

saferegex is a tool for testing regular expressions for ReDoS vulnerabilities.

License	MIT
GroupId	com.github.jkutner
ArtifactId	saferegex
Last Version	1.0.2
Release Date	Nov 3, 2020
Type	jar
Description	saferegex saferegex is a tool for testing regular expressions for ReDoS vulnerabilities.
Project URL	https://github.com/jkutner/saferegex
Source Code Management	https://github.com/jkutner/saferegex

Download saferegex

Filename	Size
saferegex-1.0.2.pom
saferegex-1.0.2.jar	90 KB
saferegex-1.0.2-sources.jar	69 KB
saferegex-1.0.2-javadoc.jar	299 KB

How to add to project

Apache Maven

<!-- https://jarcasting.com/artifacts/com.github.jkutner/saferegex/ -->
<dependency>
    <groupId>com.github.jkutner</groupId>
    <artifactId>saferegex</artifactId>
    <version>1.0.2</version>
</dependency>

Gradle Groovy

// https://jarcasting.com/artifacts/com.github.jkutner/saferegex/
implementation 'com.github.jkutner:saferegex:1.0.2'

Gradle Kotlin

// https://jarcasting.com/artifacts/com.github.jkutner/saferegex/
implementation ("com.github.jkutner:saferegex:1.0.2")

Apache Buildr

'com.github.jkutner:saferegex:jar:1.0.2'

Apache Ivy

<dependency org="com.github.jkutner" name="saferegex" rev="1.0.2">
  <artifact name="saferegex" type="jar" />
</dependency>

Groovy Grape

@Grapes(
@Grab(group='com.github.jkutner', module='saferegex', version='1.0.2')
)

Scala SBT

libraryDependencies += "com.github.jkutner" % "saferegex" % "1.0.2"

Leiningen

[com.github.jkutner/saferegex "1.0.2"]

Dependencies

test (1)

Group / Artifact	Type	Version
junit : junit	jar	4.12

Project Modules

There are no modules declared in this project.

SafeRegex

SafeRegex is a tool that tests regular expressions for ReDoS vulnerabilities. In contrast to similar tools, SafeRegex doesn't use plain fuzzing to detect vulnerabilites but uses an approach similar to model checking. This makes it much more effective than plain fuzzers.

Usage

Build the executable JAR:

$ ./mvnw clean package

Run the JAR against an evil regex:

$ java -jar target/saferegex.jar "(a|aa)+"

Testing: (a|aa)+
More than 10000 samples found.
***
This expression is vulnerable.
Sample input: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaab

Or a safe regex:

$ java -jar target/saferegex.jar "(ht|f)tp(s?)\:\/\/[0-9a-zA-Z]([-.a-zA-Z_]*[0-9a-zA-Z])*(:(0-9)*)?(\/?)([a-zA-Z0-9\-\.\?\,\:\'\/\\\+=&%\$#_]*)?"

Testing: (ht|f)tp(s?)\:\/\/[0-9a-zA-Z]([-.a-zA-Z_]*[0-9a-zA-Z])*(:(0-9)*)?(\/?)([a-zA-Z0-9\-\.\?\,\:\'\/\\\+=&%\$#_]*)?
More than 10000 samples found.
************************************************************************************************************************************************************************************************************
*****************************************************************************************************************************
Tests: 3297
Broken samples: 0
This expression is probably not vulnerable for sample sizes < 10000

Usage as a dependency

<dependency>
    <groupId>com.github.jkutner</groupId>
    <artifactId>saferegex</artifactId>
</dependency>

History

The project was created on Feb 16, 2011 by Sebastian Kübeck and hosted on Google Code. This project has been forked from the original and now maintained by Joe Kutner.

License

Apache License, Version 2.0

Versions

Version
1.0.2 Nov 3, 2020
1.0.0 Apr 18, 2018