Module 2

1. What is ReDOS and what part do ‘Evil Regex’ play?

• ReDOS, or Regular expression Denial Of Service, is a phenomenon that arises when a regular expression is constructed in a manner that leads to an application's excessive utilization of computational resources, culminating in a denial of service (DoS) attack (OWASP Foundation, N.D.).
• This situation can occur when a regular expression incorporates a pattern that permits multiple matching possibilities, thereby resulting in an exponential increase in potential matches.
• 'Evil Regex' refers to regular expressions that are intentionally designed to exploit ReDOS vulnerabilities. These expressions may contain specific patterns or constructs that trigger excessive backtracking, causing the application to become overwhelmed.

2. What are the common problems associated with the use of regex? How can these be mitigated?

• Complexity and Readability: Regex can become very complex and hard to read or maintain, especially for larger expressions.
• Incorrect Syntax: Errors in regex syntax can lead to unexpected behavior or failures.
• Performance Issues: Poorly designed regex patterns can impact performance and consume unnecessary resources.
• Security Vulnerabilities: Regex can be used to inject malicious code or perform other attacks if not properly sanitized and validated.

• Use a well-tested regex library that provides built-in protections against ReDOS and other vulnerabilities.
• Conduct regular code reviews to identify potential regex-related security issues.
• Test regex thoroughly with different inputs to ensure it behaves as expected and doesn't cause excessive backtracking.
• Avoid overly complex patterns and try to break down regex into smaller, manageable components.

3. How and why could regex be used as part of a security solution?

• Regex is often used to validate inputs to ensure they meet certain criteria and prevent malformed or malicious data from being processed.
• Regex is used to identify specific patterns within data, such as email addresses, phone numbers etc.
• Regex is used when working with files for search and replace.
• Regex can be used to detect and block SQL injection, cross-site scripting (XSS), or other injection-based attacks by ensuring that input doesn’t contain malicious patterns.