Hacker News Reader

I'm using a great ReDoS checker.

https://github.com/makenowjust-labs/recheck

I use the checker to basically fix even regular expressions that are not actually vulnerable. This checker can be used as a lint, so there is no excuse to allow regular lint but not regular expression lint. ReDoS hunt is very enjoyable. Enjoy!

View on HN

Playground is ready. Try it!

https://makenowjust-labs.github.io/recheck/playground/

you could use a regex library not vulnerable to quadratic behaviour in the first place?

This is not actionable general-purpose advice: many languages have regular expression APIs built around PCRE, which is much more of a "general advanced pattern matching" language than just pure regular expressions. Many of PCRE's features (like backreferences) are widely used and allow for parsing of non-regular inputs, meaning that you can't transform them into a linearly-evaluable regular expression.

Reply on news.ycombinator.com