Fix ReDoS in Python and Flask
=============================

A validation regex with a nested quantifier backtracks catastrophically on
CPython's re: a 30-character string runs for tens of seconds and, while it
holds the GIL, freezes the whole process. Rewrite the pattern to drop the
nested quantifier so matching is linear, cap the input length, and keep
untrusted input off any backtracking regex.

Page: https://softwaresecurity.com/fix/regex-dos/python-flask/

What is in this archive
-----------------------
regex-dos/python-flask/   the project: three implementations of the same code and one test suite
  impl/vulnerable.py   (vulnerable)
  impl/fixed.py   (fixed)
  impl/wrong.py   (a plausible fix that still fails)
run-all.mjs   runs the tests in all three modes and checks the results (Node.js only)
LICENSE-CODE.txt

Run it
------
  Tested with CPython 3.14.8. run-all.mjs needs Node.js 22 or later. Supported
  versions: https://softwaresecurity.com/fix/versions/

  From the regex-dos/python-flask folder, install the dependencies once (this
  needs network access):

    python3 -m venv .venv
    .venv/bin/python -m pip install -r requirements.txt

  Then run the tests. IMPL chooses the implementation the tests load:

    # every test passes
    IMPL=fixed .venv/bin/python -m pytest
    # an exploit test fails
    IMPL=vulnerable .venv/bin/python -m pytest
    # a test fails
    IMPL=wrong .venv/bin/python -m pytest

  The JUnit report is written to reports/junit.xml. To run all three modes and
  check the results in one step, run the harness from this top folder (it needs
  only Node.js; --install runs the install step first):

    node run-all.mjs --install regex-dos/python-flask
    node run-all.mjs regex-dos/python-flask

Verified
--------
  11 October 2026, with python 3.14.8, flask 3.1.3, pytest 9.1.1, os macOS 27.0,
  Apple M5 Max. Versions and results hold for that date: run the tests with your
  own versions before relying on the fix.

Licence
-------
  The code is MIT licensed (LICENSE-CODE.txt). The page text is CC BY 4.0.
