Page History

...

• Matching flags: Untrusted inputs may override matching options that may or may not have been passed to the Pattern.compile() method.
• Greediness: An untrusted input may attempt to inject a regex that changes the original regex to match as much of the string as possible, exposing sensitive information.
• Grouping: The programmer can enclose parts of a regular expression in parentheses to perform some common action on the group. An attacker may be able to change the groupings by supplying untrusted input, leading to the security weaknesses described earlier.

Untrusted input shall should be sanitized before use to prevent regex injection. When the user must specify a regex as input, care must be taken to ensure that the original regex cannot be modified without restriction. Whitelisting characters (such as letters and digits) before delivering the user-supplied string to the regex parser is a good input sanitization strategy. A programmer must provide only a very limited subset of regular expression functionality to the user to minimize any chance of misuse.

...

Suppose a system log file contains messages output by various system processes. Some processes produce public messages and some processes produce sensitive messages marked '"private'." Here is an example log file:

...

A user wishes to search the log file for interesting messages , but is restricted from the private ones. A program might accomplish this by permitting the user to provide search text which becomes part of the following regex:

...

This code permits a trusted user to search for public log messages such as "error." . However, it also allows a malicious attacker to perform the regex injection outlined above.

...

Related Guidelines

...

...