Sound Static Analysis of Regular Expressions for Vulnerabilities to Denial of Service Attacks (Extended Version) - Archive ouverte HAL Accéder directement au contenu
Article Dans Une Revue Science of Computer Programming Année : 2023

Sound Static Analysis of Regular Expressions for Vulnerabilities to Denial of Service Attacks (Extended Version)

Résumé

Modern programming languages often provide functions to manipulate regular expressions in standard libraries. If they offer support for advanced features, the matching algorithm has an exponential worst-case time complexity: for some so-called vulnerable regular expressions, an attacker can craft ad hoc strings to force the matcher to exhibit an exponential behaviour and perform a Regular Expression Denial of Service (ReDoS) attack. In this paper, we introduce a framework based on a tree semantics to statically identify ReDoS vulnerabilities. In particular, we put forward an algorithm to extract an overapproximation of the set of words that are dangerous for a regular expression, effectively catching all possible attacks. We have implemented the analysis in a tool called rat, and testing it on a dataset of 74,669 regular expressions, we observed that in 99.78% of the instances the analysis terminates in less than one second. We compared rat to seven other ReDoS detectors, and we found that our tool is faster, often by orders of magnitude, than most other tools. While raising a low number of false positives, rat is the only ReDoS detector that does not report false negatives.
Fichier principal
Vignette du fichier
main.pdf (738.91 Ko) Télécharger le fichier
Origine Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-04219316 , version 1 (27-09-2023)

Identifiants

Citer

Francesco Parolini, Antoine Miné. Sound Static Analysis of Regular Expressions for Vulnerabilities to Denial of Service Attacks (Extended Version). Science of Computer Programming, 2023, 229, pp.102960. ⟨10.1016/j.scico.2023.102960⟩. ⟨hal-04219316⟩
21 Consultations
78 Téléchargements

Altmetric

Partager

Gmail Mastodon Facebook X LinkedIn More