Regex without timeout guard (ARCH7074)

Key php.performance.regex-timeout · Severity info · Category performance

Matching untrusted input with an unbounded regex can lock the CPU through catastrophic backtracking (ReDoS) on pathological patterns. Cap input length or set the PCRE backtracking limit.

Incorrect

<?php
function matches(string $input): bool
{
    return (bool) preg_match('/^(\w+)+$/', $input);
}

Correct

<?php
function matches(string $input): bool
{
    if (strlen($input) > 256) {
        return false;
    }
    ini_set('pcre.backtrack_limit', '100000');
    return (bool) preg_match('/^\w+$/', $input);
}

Fix

Bound input length and constrain backtracking via pcre.backtrack_limit to prevent ReDoS.