Oh no! My regex is causing a Denial of Service! What can I do about it?
summary
Covers Python’s backtracking regular-expression engine and how certain patterns can produce catastrophic backtracking (ReDoS). Demonstrates concrete examples of problematic regexes, shows how to detect them (including static-analysis approaches), and presents techniques to improve performance and mitigate malicious input.
AI-written summary · about
chapters (9)
- 0:00Start
- 2:31Relevance today
- 3:57What is Backtracking?
- 14:40Identifying Susceptible Expressions
- 18:31Can we backtrack catastrophically?
- 20:17Avoiding Catastrophic Backtracking
- 27:59What does this match?
- 28:29Takeaways
- 30:06References
related talks
43mTotal ReDoS: the dangers of regex in JavaScript
38mTotal ReDoS: the Dangers of Regex in JavaScript
31mService Denied! Understanding How Regex DoS Attacks Work
26mTotal ReDoS: The Dangers of regex in JavaScript
01h 37mTime to Use Regular Expressions More, Um, Regularly
21mFreezing the Web: A Study of ReDoS Vulnerabilities in JavaScript-based Web Servers
40mWeb Application Firewalls: Analysis of Detection Logic
47mDenial of Service with a Fistful of Packets: Exploiting Algorithmic Complexity Vulnerabilities