Tools

ReDoS checker

Check a JavaScript regular expression for the nested, overlapping and adjacent repeats that make backtracking slow, then time it against attack strings in a worker this page can stop.

LOCAL UTILITY / 06

Check a regular expression

Enter a JavaScript regular expression to find the shapes that make backtracking engines slow, then time it against attack strings built from what was found. The pattern is analyzed and run in this browser, in a worker this page stops after a time limit, and is not sent anywhere.

Loading the local checker… If this remains visible, refresh the page.

Pattern report

Findings
Finding	Severity	Why it matters and what to do

Timing probe

The probe matches attack strings of growing length, each built from a finding: a prefix that reaches the risky part, a run of the repeated character and a character that makes the match fail. Each match runs in a worker and is stopped after a second.

Fix a pattern that backtracks

Rewrite the pattern so each input can match only one way: drop the inner repeat of a nested quantifier, make alternatives exclusive and put a required separator between repeats of the same characters. Then cap the input length before matching, and keep the attack string as a regression test.

JavaScript

// Before: nested quantifier, exponential on "aaaaaaaaaaaaaaaaaaaaaaaaaaaaa!"
const slug = /^([a-z0-9]+-?)*$/;
// After: each character is consumed one way, and the length is capped first
const SLUG = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
const isSlug = value => value.length <= 64 && SLUG.test(value);

Where users supply the patterns, or the pattern must stay ambiguous, use a linear-time engine such as RE2 (through a binding such as the re2 package for Node.js) or .NET's NonBacktracking option. The analysis here is a heuristic: it can miss shapes that only some inputs exercise and flag shapes that your engine optimizes, which is why the probe times the pattern in this browser's engine.

What is checked

Nested quantifiers whose inner repeat can start where the next outer iteration starts, as in (a+)+, (\w+\s?)+ and ([a-z0-9]+-?)*
Alternatives in a repeat that can match the same text, as in (a|a)+, (\w|\d)+ and (a|aa)+, and repeated groups that can match the empty string
Adjacent repeats where the boundary between them can move, as in \d+\d+ and .*.*
Unanchored patterns that start with a repeat before something that can fail, as in \s+$
Backreferences, which linear-time engines do not support
A timing probe: attack strings of growing length, matched in a worker that the page stops after a second

Source specifications

Guides and practice

All tools

Guide

Validate input safely and prevent regex denial of service

Find and fix exponential and quadratic regex backtracking with measured examples, choose linear-time engines or timeouts, and build allowlist validation that decodes once and rejects type confusion and parameter pollution.

Guide

Keep untrusted values out of executable syntax

Choose a safe interface for each interpreter and bound the work performed by parsers and converters.