# Inefficient Regular Expression Complexity (CWE-1333)

The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

**Stack:** Go

- Prevalence: मध्यम 3 भाषाएँ कवर की गईं
- Impact: उच्च 1 उच्च गंभीरता वाले नियम
- Prevention: प्रलेखित 3 फिक्स उदाहरण

**OWASP:** Injection (A03:2021-Injection) - #3

## Description

Certain regular expression patterns can take exponential time to evaluate on certain inputs (ReDoS). Attackers can craft inputs that cause the regex engine to consume excessive CPU time, leading to denial of service.

## Prevention

1 Shoulder डिटेक्शन नियमों पर आधारित ReDoS के लिए रोकथाम रणनीतियाँ।

### Go

Avoid nested quantifiers in regex; use specific character classes instead

## Consequences

- DoS

## Mitigations

- regex में नेस्टेड quantifiers और ओवरलैपिंग alternations से बचें
- regex के लिए timeout तंत्रों का उपयोग करें
- non-backtracking regex engines का उपयोग करने पर विचार करें

## Detection

- Total rules: 3
- Languages: go, javascript, typescript, python

## Rules by Language

### Go (1 rules)

- **Regular Expression Denial of Service** [MEDIUM]: Regex pattern with nested quantifiers causes catastrophic backtracking.
  - Remediation: Avoid nested quantifiers like (a+)+. Use possessive quantifiers or atomic groups.

```go
// Avoid patterns like: (a+)+, (.*)*
// Use specific patterns instead
re := regexp.MustCompile(`^[a-z]+$`)
```

Learn more: https://shoulder.dev/learn/go/cwe-1333/regex-dos