JS: Lower field-flow branch limit on Polynomial ReDoS

asgerf · asgerf · commit e4bc19355546 · 2023-10-10T11:07:36.000+02:00
diff --git a/javascript/ql/lib/semmle/javascript/security/regexp/PolynomialReDoSQuery.qll b/javascript/ql/lib/semmle/javascript/security/regexp/PolynomialReDoSQuery.qll
@@ -27,6 +27,8 @@ module PolynomialReDoSConfig implements DataFlow::ConfigSig {
     // TODO: localFieldStep is too expensive with dataflow2
     // DataFlow::localFieldStep(pred, succ)
   }
+
+  int fieldFlowBranchLimit() { result = 1 } // library inputs are too expensive on some projects
 }
 
 /** Taint-tracking for reasoning about polynomial regular expression denial-of-service attacks. */

Original file line number	Diff line number	Diff line change
`@@ -27,6 +27,8 @@ module PolynomialReDoSConfig implements DataFlow::ConfigSig {`
`27`	`27`	`// TODO: localFieldStep is too expensive with dataflow2`
`28`	`28`	`// DataFlow::localFieldStep(pred, succ)`
`29`	`29`	`}`
	`30`	`+`
	`31`	`+ int fieldFlowBranchLimit() { result = 1 } // library inputs are too expensive on some projects`
`30`	`32`	`}`
`31`	`33`
`32`	`34`	`/** Taint-tracking for reasoning about polynomial regular expression denial-of-service attacks. */`