Regex timeout (ARCH4074)

Key java.performance.regex-timeout · Severity info · Category performance

Matching untrusted input with no length cap or time guard leaves you exposed to ReDoS. A malicious input can force a backtracking regex to burn CPU for seconds.

Incorrect

public boolean valid(String input) {
    return input.matches("(a+)+$");
}

Correct

private static final Pattern P = Pattern.compile("(a+)+$");

public boolean valid(String input) {
    if (input.length() > 256) return false;
    return P.matcher(input).matches();
}

Fix

Cap the input length and, where possible, use a non-backtracking pattern.