Regex denial of service (ARCH2135)

Key python.security.regex-dos · Severity warning · Category security · CWE CWE-1333

Regular expressions with nested quantifiers cause catastrophic backtracking and denial of service (ReDoS) when applied to untrusted input.

Incorrect

import re

def is_valid(s):
    return re.fullmatch(r"(\w+)+$", s) is not None

Correct

import re

def is_valid(s):
    return re.fullmatch(r"\w+", s) is not None

Fix

Simplify the pattern to eliminate nested quantifiers, or bound the length of untrusted input.