Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

False positive in redos detection when nested quantifier mutually exclusive #13

Open
mschwager opened this issue Jan 10, 2020 · 1 comment

Comments

@mschwager
Copy link
Contributor

"A group that contains a token with a quantifier must not have a quantifier of its own unless the quantified token inside the group can only be matched with something else that is mutually exclusive with it." (Nested Quantifiers)

Dlint does not currently eliminate safe regular expressions that have nested quantifiers but they're mutually exclusive. Consider the example from the above link:

$ python -m dlint.redos -p '(x\w{1,10})+y'
('(x\\w{1,10})+y', True)

Dlint finds the nested quantifier. But it flags the corrected code as well:

$ python -m dlint.redos -p '(x[a-wyz0-9_]{1,10})+y'
('(x[a-wyz0-9_]{1,10})+y', True)

This example is okay because there's no character overlap inside the nested quantifier. We should fix this false positive.

@remram44
Copy link

I ran into (ab+)+c which I think falls into this category:

$ python -m dlint.redos -p '(ab+)+c'
('(ab+)+c', True)

My actual regex is ^POLYGON ?\(\([0-9 .]+\)(, ?\([0-9 .]+\))*\)$ (for WKT) which I couldn't find any way to fix.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants