Page History

* Greediness

Since Java regular expressions are similar to Perl, it is a good idea to apply lessons learned from Perl regex.


h2. Noncompliant Code Example

This class does not sanitize the incoming regular expression, and as a result, exposes too much information to the user.

This program searches a database of users for usernames that match a regular expression.

{noformat}
A non-malicious example would be to search for 'John.*'. A malicious example would be to search for '(?s)John.*'

{noformat}


{code:bgColor=#FFCCCC}
{code}
import java.util.regex.Pattern;
import java.util.regex.Matcher;
import java.util.Set;
import java.util.HashSet;

public class ForumUserMan
{
    private final String userCSV = "JohnPaul,HearsGodsVoice\nJohnJackson,OlympicBobsleder\nJohnMayer,MakesBadMusic\n";

    public Set<String> searchUser(String name)
    {
        Set<String> matchedUsers = new HashSet<String>();

        String regex = name + ","; //supposedly this forces the regex to only match names
        Pattern p = Pattern.compile(regex, 0);
        Matcher m = p.matcher(userCSV);

        while (m.find())
            matchedUsers.add(m.group());

        return matchedUsers;
    }
}
{code}

When searching using the regex '(?s)John.*', the program returns all the users' passwords. The (?s) turns on single-line matching support, which means new lines are ignored.

 

{code:bgColor=#ccccff}
{code}
import java.util.regex.Pattern;
import java.util.regex.Matcher;
import java.util.HashMap;

/* Usage Test2 <regex>
 * Regex is used directly without santization causing sensitive data to be exposed
 *
 * Imagine this program searches a database of users for usernames that match a regex
 * Non malicious usage: Test1 John.*
 * Malicious usage: (?s)John.*
 */
public class Test2
{
    public static class User
    {
        String name, password;
        public User(String name, String password)
        {
            setName(name);
            setPassword(password);
        }
        private void setName(String n) { name = n; }
        private void setPassword(String pw) { password = pw; }
        public String getName() { return name; }
    }

    public static void main(String[] args)
    {
        if (args.length < 1) {
            System.err.println("Failed to specify a regex");
            return;
        }

        String sensitiveData; //represents sensitive data from a file or something
        int flags;
        String regex;
        Pattern p;
        Matcher m;
        HashMap<String, User> userMap = new HashMap<String, User>();

        //imagine a CSV style database: user,password
        sensitiveData = "JohnPaul,HearsGodsVoice\nJohnJackson,OlympicBobsleder\nJohnMayer,MakesBadMusic\n";
        String[] csvUsers = sensitiveData.split("\n");
        for (String csvUser : csvUsers) {
            String[] csvUserSplit = csvUser.split(",");
            String name = csvUserSplit[0];
            String pw = csvUserSplit[1];
            User u = new User(name, pw);
            userMap.put(name, u);
        }


        regex = args[0];
        flags = 0;

        System.out.println("Pattern: \'" + regex + "\'");
        p = Pattern.compile(regex, flags);


        for (String u : userMap.keySet()) {
            m = p.matcher(u);
            while (m.find())
                System.out.println("Found \'" + m.group() + "\'");
        }
        System.err.println("DONE");
    }
}