mcp-server-semgrep/semgrep-rules/python/lang/security/audit/regex-dos.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: regex_dos
  patterns:
  - pattern: |
      $A = re.compile("$B", ...)
      ...
      $A.$METHOD(...)
  - metavariable-analysis:
      analyzer: redos
      metavariable: $B
  - metavariable-regex:
      metavariable: $METHOD
      regex: (?!(escape)|(purge))
  message: >-
    Detected usage of re.compile with an inefficient regular expression.
    This can lead to regular expression denial of service, which can result
    in service down time. Instead, check all regexes or use safer alternatives
    such as pyre2.
  languages:
  - python
  severity: WARNING
  metadata:
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
    subcategory:
      - vuln
    owasp: 'A06:2017 - Security Misconfiguration'
    cwe: 'CWE-1333: Inefficient Regular Expression Complexity'
    category: security
    technology:
    - python
    references:
    - 'https://docs.python.org/3/library/re.html'