正则表达式 DoS 攻击(ReDoS)

[gkiwi]

拿去玩：

import time
import re

def redos(data):
    start = time.time()
    regex = re.compile("^(a+)+$")
    #regex = re.compile('(a+)+')
    regex.match(data)
    end = time.time() - start
    print("%f" % end)

if __name__ == '__main__':
    for i in xrange(1,30):
        data = 'a'*i + '!'
        redos(data)

修改自： https://github.com/pete911/redos/blob/master/redos.py

---

介绍：

https://msdn.microsoft.com/zh-cn/magazine/ff646973.aspx

https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS

---

目前知道的几个 Evil Regex ：

http://stackoverflow.com/questions/12841970/how-can-i-recognize-an-evil-regex