Regex timeout (ARCH306)

Key dotnet.security.regex-timeout · Severity warning · Category security · CWE CWE-1333

A regex run without a timeout can backtrack exponentially on crafted input (ReDoS), causing denial of service. Always specify a match timeout.

Incorrect

var match = Regex.IsMatch(input, @"^(a+)+$");

Correct

var match = Regex.IsMatch(
    input, @"^(a+)+$", RegexOptions.None, TimeSpan.FromSeconds(1));

Fix

Pass a TimeSpan timeout to every regex operation on user-controlled input (or set an AppDomain-wide default).