org.sonar.plugins.csharp.S6444.html Maven / Gradle / Ivy

Go to download

Show more of this group Show more artifacts with this name
Show all versions of sonar-csharp-plugin Show documentation

Code Analyzer for C#

There is a newer version: 10.2.0.105762

Not specifying a timeout for regular expressions can lead to a Denial-of-Service attack. Pass a timeout when using
System.Text.RegularExpressions to process untrusted input because a malicious user might craft a value for which the evaluation lasts
excessively long.
Ask Yourself Whether

   the input passed to the regular expression is untrusted. 
   the regular expression contains patterns vulnerable to catastrophic
  backtracking. 

There is a risk if you answered yes to any of those questions.
Recommended Secure Coding Practices

   It is recommended to specify a matchTimeout when executing a
  regular expression. 
   Make sure regular expressions are not vulnerable to Denial-of-Service attacks by reviewing the patterns. 
   Consider using a non-backtracking algorithm by specifying RegexOptions.NonBacktracking. 

Sensitive Code Example
public void RegexPattern(string input)
{
    var emailPattern = new Regex(".+@.+", RegexOptions.None);
    var isNumber = Regex.IsMatch(input, "[0-9]+");
    var isLetterA = Regex.IsMatch(input, "(a+)+");
}

Compliant Solution
public void RegexPattern(string input)
{
    var emailPattern = new Regex(".+@.+", RegexOptions.None, TimeSpan.FromMilliseconds(100));
    var isNumber = Regex.IsMatch(input, "[0-9]+", RegexOptions.None, TimeSpan.FromMilliseconds(100));
    var isLetterA = Regex.IsMatch(input, "(a+)+", RegexOptions.NonBacktracking); // .Net 7 and above
    AppDomain.CurrentDomain.SetData("REGEX_DEFAULT_MATCH_TIMEOUT", TimeSpan.FromMilliseconds(100)); // process-wide setting
}

See

   OWASP - Top 10 2017 Category A1 - Injection 
   CWE - CWE-400 - Uncontrolled Resource Consumption 
   CWE - CWE-1333 - Inefficient Regular Expression Complexity 
   regular-expressions.info - Runaway Regular Expressions: Catastrophic
  Backtracking 
   owasp.org - Regular expression Denial of
  Service - ReDoS 
   CWE - CWE-1333 - Inefficient Regular Expression Complexity 
   docs.microsoft.com - Best practices for regular expressions
  in .NET 
   docs.microsoft.com - Backtracking in
  Regular Expressions 
   devblogs.microsoft.com - Regular Expression Improvements in .NET 7: Backtracking (and RegexOptions.NonBacktracking) 
   docs.microsoft.com - Regex.MatchTimeout
  Property 
   docs.microsoft.com - RegexOptions
  Enum (NonBacktracking option)