René's URL Explorer Experiment

Title: Enable polynomial ReDoS query to use plain `regex-use` sinks by Copilot · Pull Request #21115 · github/codeql · GitHub

Open Graph Title: Enable polynomial ReDoS query to use plain `regex-use` sinks by Copilot · Pull Request #21115 · github/codeql

X Title: Enable polynomial ReDoS query to use plain `regex-use` sinks by Copilot · Pull Request #21115 · github/codeql

Description: The polynomial ReDoS query couldn't detect vulnerabilities in Apache Commons Lang3 RegExUtils methods because they use the plain regex-use sink kind, while regexSinkKindInfo only parsed bracketed forms like regex-use[0]. Changes Extended regexSinkKindInfo predicate to handle plain regex-use with defaults: non-full-string matching, string argument at index 0 Updated comment in org.apache.commons.lang3.model.yml to document the behavior Added test coverage for all RegExUtils methods in polynomial ReDoS test suite Technical Details The plain regex-use kind is used by methods where both pattern and input are provided in a single call, like RegExUtils.removeAll(text, regex). The defaults (full=false, strArg=0) match this signature pattern where the regex is at Argument[1] and the text to match is at Argument[0]. This preserves the existing behavior where regex injection and polynomial ReDoS queries select different sink kinds to avoid false positives, while enabling the ReDoS query to analyze these methods. private predicate regexSinkKindInfo(string kind, boolean full, int strArg) { sinkModel(_, _, _, _, _, _, _, kind, _, _) and ( exists(string fullStr, string strArgStr | /* bracketed forms */ ) or // Plain regex-use sinks default to non-full-string matching with string arg at index 0 kind = "regex-use" and full = false and strArg = 0 ) } Original prompt Work on TODO: refactor the regex-use% sink kind so that the polynomial ReDoS query (from java/ql/lib/semmle/code/java/regex/RegexFlowConfigs.qll) Created from VS Code via the GitHub Pull Request extension. 💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

Open Graph Description: The polynomial ReDoS query couldn't detect vulnerabilities in Apache Commons Lang3 RegExUtils methods because they use the plain regex-use sink kind, while regexSinkKindInfo only parsed bracket...

X Description: The polynomial ReDoS query couldn't detect vulnerabilities in Apache Commons Lang3 RegExUtils methods because they use the plain regex-use sink kind, while regexSinkKindInfo only parsed bra...

Opengraph URL: https://github.com/github/codeql/pull/21115

X: @github

direct link

Domain: patch-diff.githubusercontent.com

Links:

Viewport: width=device-width