Unsanitized user input in regular expression

• Rule ID: ruby_lang_regex_using_user_input
• Languages: ruby
• Source: regex_using_user_input.yml

Description

Applications should avoid constructing regular expressions from user input. Regular expressions can have exponential worst-case computational complexity, allowing users to trigger this behaviour can result in excessive CPU consumption causing a regular expression denial of service (ReDoS).

Remediations

❌ Avoid using untrusted or user data when building regular expressions

✅ Specify a timeout when working with regular expressions

  Regexp.new(/(a|b)/, timeout: 3)

Resources

• OWASP ReDoS attacks explained

Associated CWE

• CWE-1287: Improper Validation of Specified Type of Input

Configuration

To skip this rule during a scan, use the following flag

bearer scan /path/to/your-project/ --skip-rule=ruby_lang_regex_using_user_input

To run only this rule during a scan, use the following flag

bearer scan /path/to/your-project/ --only-rule=ruby_lang_regex_using_user_input