Derivative-Based Diagnosis of Regular Expression Ambiguity

Sulzmann, Martin; Lu, Kenny Zhuo Ming

doi:10.1142/s0129054117400068

Cited by 5 publications

(3 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Figure 2 illustrates an example of exponential behavior. Many researchers have proposed tools to identify regex-input pairs with worst-case polynomial or exponential behavior [27,30,77,87,89,94,100,101,111,114]. Using the typical Spencer algorithm [97], viz.…”

Section: Regexes and Regex-based Denial Of Servicementioning

confidence: 99%

Exploiting input sanitization for regex denial of service

Barlas

Davis

2022

Proceedings of the 44th International Conference on Software Engineering

View full text Add to dashboard Cite

Web services use server-side input sanitization to guard against harmful input. Some web services publish their sanitization logic to make their client interface more usable, e.g., allowing clients to debug invalid requests locally. However, this usability practice poses a security risk. Specifically, services may share the regexes they use to sanitize input strings -and regex-based denial of service (ReDoS) is an emerging threat. Although prominent service outages caused by ReDoS have spurred interest in this topic, we know little about the degree to which live web services are vulnerable to ReDoS.In this paper, we conduct the first black-box study measuring the extent of ReDoS vulnerabilities in live web services. We apply the Consistent Sanitization Assumption: that client-side sanitization logic, including regexes, is consistent with the sanitization logic on the server-side. We identify a service's regex-based input sanitization in its HTML forms or its API, find vulnerable regexes among these regexes, craft ReDoS probes, and pinpoint vulnerabilities. We analyzed the HTML forms of 1,000 services and the APIs of 475 services. Of these, 355 services publish regexes; 17 services publish unsafe regexes; and 6 services are vulnerable to ReDoS through their APIs (6 domains; 15 subdomains). Both Microsoft and Amazon Web Services patched their web services as a result of our disclosure. Since these vulnerabilities were from API specifications, not HTML forms, we proposed a ReDoS defense for a popular API validation library, and our patch has been merged. To summarize: in client-visible sanitization logic, some web services advertise Re-DoS vulnerabilities in plain sight. Our results motivate short-term patches and long-term fundamental solutions."Make measurable what cannot be measured. " -Galileo Galilei CCS CONCEPTS• Security and privacy → Denial-of-service attacks; Web application security; • General and reference → Empirical studies; Measurement; Validation.

show abstract

Section: Regexes and Regex-based Denial Of Servicementioning

confidence: 99%

Exploiting input sanitization for regex denial of service

Barlas

Davis

2022

Proceedings of the 44th International Conference on Software Engineering

View full text Add to dashboard Cite

show abstract

“…For (2) we need to enumerate all possible parse trees. This is possible by extending our prior work [20,21] to the regular equation setting. Details are given in Appendix B.…”

Section: Computational Interpretationmentioning

confidence: 99%

“…That is, if a parse exists the parser will succeed. It is possible to compute all parse trees following the scheme outlined in [21]. For brevity, we omit the details.…”

Section: A Proofsmentioning

confidence: 99%

Solving of Regular Equations Revisited

Sulzmann

2019

Theoretical Aspects of Computing – ICTAC 2019

Self Cite

View full text Add to dashboard Cite

Solving of regular equations via Arden's Lemma is folklore knowledge. We first give a concise algorithmic specification of all elementary solving steps. We then discuss a computational interpretation of solving in terms of coercions that transform parse trees of regular equations into parse trees of solutions. Thus, we can identify some conditions on the shape of regular equations under which resulting solutions are unambiguous. We apply our result to convert a DFA to an unambiguous regular expression. In addition, we show that operations such as subtraction and shuffling can be expressed via some appropriate set of regular equations. Thus, we obtain direct (algebraic) methods without having to convert to and from finite automaton.

show abstract

A Benchmark Production Tool for Regular Expressions

Borsotti

Breveglieri

Reghizzi

et al. 2019

Implementation and Application of Automata

View full text Add to dashboard Cite

material is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation, broadcasting, reproduction on microfilms or in any other physical way, and transmission or information storage and retrieval, electronic adaptation, computer software, or by similar or dissimilar methodology now known or hereafter developed. The use of general descriptive names, registered names, trademarks, service marks, etc. in this publication does not imply, even in the absence of a specific statement, that such names are exempt from the relevant protective laws and regulations and therefore free for general use. The publisher, the authors and the editors are safe to assume that the advice and information in this book are believed to be true and accurate at the date of publication. Neither the publisher nor the authors or the editors give a warranty, expressed or implied, with respect to the material contained herein or for any errors or omissions that may have been made. The publisher remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.

show abstract

Derivative-Based Diagnosis of Regular Expression Ambiguity

Cited by 5 publications

References 11 publications

Exploiting input sanitization for regex denial of service

Exploiting input sanitization for regex denial of service

Solving of Regular Equations Revisited

A Benchmark Production Tool for Regular Expressions

Contact Info

Product

Resources

About