Description

Detects regular expressions in Kotlin code that are susceptible to ReDoS (Regular Expression Denial of Service) attacks. These vulnerabilities occur when regex patterns can be exploited with specially crafted input to cause excessive CPU consumption and application delays.

Detection Strategy

• Identifies calls to the Kotlin 'matches' method in string operations

• Checks if the regex pattern argument contains potentially dangerous constructs like nested quantifiers or backreferences

• Reports a vulnerability when the matches() method is used with a regex pattern that could cause catastrophic backtracking

• Focuses on regex patterns that allow attackers to craft input strings causing exponential evaluation time

Vulnerable code example

fun validateInput(userInput: String): Boolean {
    val maliciousRegex = "(a+)*b".toRegex()  // Vulnerable regex pattern that can cause catastrophic backtracking
    return userInput.matches(maliciousRegex)   // Dangerous: User input matched against exponential regex
}

✅ Secure code example

fun validateInput(userInput: String): Boolean {
    // Use a simple non-backtracking pattern with bounded repetition
    val safeRegex = "^[a-z]{1,30}b$".toRegex()  // Limited length, no nested quantifiers
    return userInput.matches(safeRegex)
}