diff --git a/RegExpSupport/src/META-INF/RegExpPlugin.xml b/RegExpSupport/src/META-INF/RegExpPlugin.xml index dfeec8847e2c..8ef897e37fb7 100644 --- a/RegExpSupport/src/META-INF/RegExpPlugin.xml +++ b/RegExpSupport/src/META-INF/RegExpPlugin.xml @@ -34,5 +34,7 @@ implementationClass="org.intellij.lang.regexp.inspection.SingleCharAlternationInspection"/> + diff --git a/RegExpSupport/src/inspectionDescriptions/ReDoS.html b/RegExpSupport/src/inspectionDescriptions/ReDoS.html new file mode 100644 index 000000000000..51363dcb1d5f --- /dev/null +++ b/RegExpSupport/src/inspectionDescriptions/ReDoS.html @@ -0,0 +1,14 @@ + + +Reports exponential backtracking in a RegExp, which can lead to extremely slow matching. +Exponential backtracking can happen when a single string can be matched in multiple ways, leading to exponential runtime. +Exponential backtracking is also known as Regular Expression Denial of Service (ReDoS), catastrophic backtracking, explosive quantifiers +and exponential matching. +This inspection only detects a limited form of exponential backtracking, +so the absence of a warning is not a guarantee the pattern does not contain a exponential backtracking problem. + + +

+ New in 2017.1 + + \ No newline at end of file diff --git a/RegExpSupport/src/org/intellij/lang/regexp/inspection/ReDoSInspection.java b/RegExpSupport/src/org/intellij/lang/regexp/inspection/ReDoSInspection.java new file mode 100644 index 000000000000..a0d6c95540d1 --- /dev/null +++ b/RegExpSupport/src/org/intellij/lang/regexp/inspection/ReDoSInspection.java @@ -0,0 +1,105 @@ +/* + * Copyright 2000-2017 JetBrains s.r.o. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.intellij.lang.regexp.inspection; + +import com.intellij.codeInspection.LocalInspectionTool; +import com.intellij.codeInspection.LocalInspectionToolSession; +import com.intellij.codeInspection.ProblemsHolder; +import com.intellij.lang.ASTNode; +import com.intellij.psi.PsiElementVisitor; +import com.intellij.psi.util.PsiTreeUtil; +import org.intellij.lang.regexp.RegExpTT; +import org.intellij.lang.regexp.psi.*; +import org.jetbrains.annotations.NotNull; + +/** + * @author Bas Leijdekkers + */ +public class ReDoSInspection extends LocalInspectionTool { + + @Override + public void inspectionFinished(@NotNull LocalInspectionToolSession session, @NotNull ProblemsHolder problemsHolder) { + super.inspectionFinished(session, problemsHolder); + } + + @NotNull + @Override + public PsiElementVisitor buildVisitor(@NotNull ProblemsHolder holder, + boolean isOnTheFly, + @NotNull LocalInspectionToolSession session) { + return new ReDoSVisitor(holder); + } + + private static class ReDoSVisitor extends RegExpElementVisitor { + + private final ProblemsHolder myHolder; + + public ReDoSVisitor(ProblemsHolder holder) { + myHolder = holder; + } + + @Override + public void visitRegExpClosure(RegExpClosure closure) { + if (!hasSuspiciousQuantifier(closure)) { + return; + } + RegExpClosure parent = PsiTreeUtil.getParentOfType(closure, RegExpClosure.class); + while (parent != null) { + if (hasSuspiciousQuantifier(parent)) { + if (isAtomic(closure)) { + return; + } + myHolder.registerProblem(parent, "Potential exponential backtracking"); + return; + } + parent = PsiTreeUtil.getParentOfType(parent, RegExpClosure.class); + } + } + + private static boolean hasSuspiciousQuantifier(RegExpClosure closure) { + final RegExpQuantifier quantifier = closure.getQuantifier(); + if (!quantifier.isCounted()) { + final ASTNode token = quantifier.getToken(); + return !(token == null || token.getElementType() == RegExpTT.QUEST); + } + final RegExpNumber max = quantifier.getMax(); + if (max == null) { + return true; + } + final Number value = max.getValue(); + return value == null || value.doubleValue() >= 10; + } + + private static boolean isAtomic(RegExpAtom element) { + while (element != null) { + if (element instanceof RegExpClosure) { + final RegExpClosure closure = (RegExpClosure)element; + if (closure.getQuantifier().isPossessive()) { + return true; + } + } + else if (element instanceof RegExpGroup) { + final RegExpGroup group = (RegExpGroup)element; + if (group.getType() == RegExpGroup.Type.ATOMIC) { + return true; + } + } + element = PsiTreeUtil.getParentOfType(element, RegExpClosure.class, RegExpGroup.class); + } + return false; + } + } +} diff --git a/RegExpSupport/src/org/intellij/lang/regexp/psi/RegExpNumber.java b/RegExpSupport/src/org/intellij/lang/regexp/psi/RegExpNumber.java index 248cc1ba81f8..8ef57826628a 100644 --- a/RegExpSupport/src/org/intellij/lang/regexp/psi/RegExpNumber.java +++ b/RegExpSupport/src/org/intellij/lang/regexp/psi/RegExpNumber.java @@ -15,11 +15,14 @@ */ package org.intellij.lang.regexp.psi; +import org.jetbrains.annotations.Nullable; + /** * Number consisting only of one or more decimal digits. No negation or decimal points. * @author Bas Leijdekkers */ public interface RegExpNumber extends RegExpElement { - + @Nullable + Number getValue(); } diff --git a/RegExpSupport/src/org/intellij/lang/regexp/psi/impl/RegExpNumberImpl.java b/RegExpSupport/src/org/intellij/lang/regexp/psi/impl/RegExpNumberImpl.java index 6ea6989e9dfd..8763de33b78f 100644 --- a/RegExpSupport/src/org/intellij/lang/regexp/psi/impl/RegExpNumberImpl.java +++ b/RegExpSupport/src/org/intellij/lang/regexp/psi/impl/RegExpNumberImpl.java @@ -16,8 +16,10 @@ package org.intellij.lang.regexp.psi.impl; import com.intellij.lang.ASTNode; +import org.intellij.lang.regexp.RegExpLanguageHosts; import org.intellij.lang.regexp.psi.RegExpElementVisitor; import org.intellij.lang.regexp.psi.RegExpNumber; +import org.jetbrains.annotations.Nullable; /** * @author Bas Leijdekkers @@ -28,6 +30,12 @@ public class RegExpNumberImpl extends RegExpElementImpl implements RegExpNumber super(node); } + @Nullable + @Override + public Number getValue() { + return RegExpLanguageHosts.getInstance().getQuantifierValue(this); + } + @Override public void accept(RegExpElementVisitor visitor) { visitor.visitRegExpNumber(this); diff --git a/RegExpSupport/test/org/intellij/lang/regexp/inspection/ReDoSInspectionTest.java b/RegExpSupport/test/org/intellij/lang/regexp/inspection/ReDoSInspectionTest.java new file mode 100644 index 000000000000..ec39ecd27f27 --- /dev/null +++ b/RegExpSupport/test/org/intellij/lang/regexp/inspection/ReDoSInspectionTest.java @@ -0,0 +1,47 @@ +/* + * Copyright 2000-2017 JetBrains s.r.o. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.intellij.lang.regexp.inspection; + +import com.intellij.codeInspection.LocalInspectionTool; +import org.jetbrains.annotations.NotNull; + +/** + * @author Bas Leijdekkers + */ +public class ReDoSInspectionTest extends RegExpInspectionTestCase { + + public void testNestedQuantifiers1() { + highlightTest("(.*a){10}"); + } + + public void testNestedQuantifiers2() { + highlightTest("(a+)+"); + } + + public void testPossessiveQuantifier() { + highlightTest("(a+)++"); + } + + public void testAtomicGroup() { + highlightTest("(?>a+)+"); + } + + @NotNull + @Override + protected LocalInspectionTool getInspection() { + return new ReDoSInspection(); + } +}