Regular Expression Repair Through ReDoS Detection And Synthesis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing techniques face difficulties in efficiently correcting vulnerabilities in regular expressions used in the real world, particularly those involving ReDoS attacks, and do not adequately address syntax issues like lookahead, lookbehind, and backreference.
Innovation Solution
A correction device that includes an extraction unit to extract regular expressions from source code, a determination unit to assess vulnerability, and a synthesis unit to generate invulnerable regular expressions by converting range characters into placeholders and applying predetermined syntax patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional regular expression correction techniques are used, then syntax errors can be corrected, but vulnerability to ReDoS attacks cannot be addressed
Solution Approach 1:
The correction device divides the regular expression correction process into distinct functional modules: extraction unit for obtaining regular expressions from source code, determination unit for assessing vulnerability, and synthesis unit for generating corrected expressions. This segmentation allows each module to specialize in specific tasks, enabling comprehensive correction of both syntax errors and security vulnerabilities simultaneously.
Solution Approach 2:
The determination unit performs preliminary analysis by automatically detecting whether a regular expression is vulnerable to ReDoS attacks before correction. This preliminary action identifies security issues in advance, allowing the synthesis unit to generate corrected expressions that address both syntax errors and security vulnerabilities from the outset.
2Adaptability or versatility
If existing correction methods are applied, then simple regular expressions can be corrected, but complex syntax like lookahead, lookbehind, and backreference cannot be handled
Solution Approach 1:
The synthesis unit is designed with universal correction capabilities that handle multiple types of regular expression syntax including extended features like lookahead, lookbehind, and backreference. By incorporating a comprehensive set of correction rules and patterns, the synthesis unit can adapt to various regular expression forms without requiring separate correction mechanisms for each syntax type.
3Reliability
If vulnerable regular expressions are used in source code, then development flexibility is maintained, but security risks are introduced
Solution Approach 1:
The correction device implements feedback by automatically detecting vulnerable regular expressions in source code and generating corrected versions. The determination unit provides feedback about security vulnerabilities, and the synthesis unit uses this feedback to produce corrected expressions that maintain development flexibility while eliminating security risks.
Data Source
AI summary
A correction device includes processing circuitry configured to extract a first regular expression from a source code, determine whether the first regular expression satisfies a condition indicating that the first regular expression is vulnerable to Regular Expression Denial of Service (ReDoS), and synthesize a second regular expression that does not satisfy the condition on a basis of the first regular expression.