Regular expression DoS (ARCH6135)

Key ruby.security.regex-dos · Severity warning · Category security · CWE CWE-1333

Applying a regex with nested quantifiers (causing catastrophic backtracking) to untrusted input leads to a CPU-exhausting denial of service (ReDoS).

Incorrect

def valid?(input)
  input =~ /^(a+)+$/
end

Correct

def valid?(input)
  Regexp.new("^a+$").match?(input, timeout: 1)
end

Fix

Avoid nested quantifiers and add a timeout/length limit to regex matching.