Regex Timeout (ARCH6074)

Key ruby.performance.regex-timeout · Severity warning · Category performance

A regex matched against untrusted input with no timeout can lock the CPU on malicious input through catastrophic backtracking (ReDoS). Set a timeout on the pattern.

Incorrect

def valid?(input)
  pattern = /\A(\w+)+\z/
  pattern.match?(input)
end

Correct

def valid?(input)
  pattern = Regexp.new('\A(\w+)+\z', timeout: 1.0)
  pattern.match?(input)
end

Fix

Construct regular expressions with the timeout: option, or cap the input length.