Regular Expression Verification for Linear-Time ReDoS Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional techniques for correcting Regular Expression Denial of Service (ReDoS) vulnerabilities lack certainty in verifying the effectiveness of the correction process.
Innovation Solution
A verification device that includes a first determination unit to check the syntax of a regular expression and a second determination unit to ensure the processing time is linear with respect to the length of the character string, using methods such as RWS1U to confirm the correction of vulnerabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional correction techniques (RFixer, conversion to deterministic finite automaton) are used to correct regular expression vulnerabilities, then the regular expression may be modified to reduce backtracking, but it cannot verify with certainty that the vulnerability has been corrected
Solution Approach 1:
The patent replaces manual or conventional correction verification methods with an automated verification system that uses formal methods. The verification device automatically checks whether a regular expression satisfies invulnerability conditions by analyzing its structure against predefined criteria, substituting mechanical/manual verification processes with an automated computational system that provides certain verification.
Solution Approach 2:
The patent introduces a verification device as an intermediary between the regular expression correction process and the final validation. This intermediary component independently verifies whether the corrected regular expression meets invulnerability requirements, providing an additional layer of verification that bridges the gap between correction and certainty validation.
2Adaptability or versatility
If backtracking-based regular expression engines are used, then the engine can handle complex patterns, but it requires exponential time for vulnerable regular expressions
Solution Approach 1:
The patent applies preliminary action by verifying the invulnerability of a regular expression before it is deployed or executed. The verification device checks the regular expression structure in advance to ensure it meets linear-time processing conditions, preventing future exponential time consumption without modifying the engine's backtracking capability.
Solution Approach 2:
The patent changes the parameter of time complexity analysis by establishing verification criteria that ensure linear time complexity O(n) with respect to input length. The verification device checks whether the regular expression structure guarantees linear processing time, transforming the time complexity parameter from potentially exponential to linear through structural validation.
Data Source
AI summary
A verification device according to an embodiment includes a first determination unit and a second determination unit. The first determination unit determines whether a regular expression follows a syntax (for example, a syntax of a regular expression according to the Backus-Naur form) designated in advance. The second determination unit determines whether a condition (for example, real-world strong 1-unambiguity (RWS1U)) indicating that the processing time when the regular expression analyzes a character string is linear with respect to the length of the character string is satisfied.