The re module. Catastrophic backtracking in regex patterns (ReDoS) — finding when a user-controlled pattern flows into re.compile / re.search / re.match. Also, re.findall on untrusted HTML is a common anti-pattern that misses cases.
.compile().match().search().sub().compile()Sinkre.compile(pattern, flags=0) -> Pattern
Compiles a regex. ReDoS sink when pattern is user-controlled.
0.match()Sinkre.match(pattern, string, flags=0) -> Match | None
Matches at start of string. ReDoS sink on user-controlled pattern.
0.search()Sinkre.search(pattern, string, flags=0) -> Match | None
Searches for pattern. ReDoS sink on user-controlled pattern.
0.sub()Sinkre.sub(pattern, repl, string, count=0, flags=0) -> str
Regex-based substitution. ReDoS sink on user-controlled pattern.
0| FQN | Field | |
|---|---|---|
| re | fqns[0] |
Wrong FQN → 0 findings. Verify with: change fqns to garbage → must produce 0 results.
from codepathfinder.go_rule import PyRe