Regular expression DoS (ARCH7135)

Key php.security.regex-dos · Severity warning · Category security · CWE CWE-1333

Regular expressions with nested quantifiers (e.g. (a+)+) cause exponential backtracking on certain inputs. Applied to untrusted input, an attacker can pin the CPU with a single request (ReDoS). The pattern must be rewritten or the input bounded.

Incorrect

<?php
$input = $_GET['q'];
if (preg_match('/^(\w+\s?)+$/', $input)) {
    // ...
}

Correct

<?php
$input = $_GET['q'];
if (strlen($input) > 256) {
    http_response_code(400);
    exit;
}
if (preg_match('/^\w+(\s\w+)*$/', $input)) {
    // ...
}

Fix

Rewrite the pattern to remove nested quantifiers and bound the length of the input.