contrib.nodejsscan.regex_injection.regex_injection_dos

rules:
  - id: regex_injection_dos
    patterns:
      - pattern-either:
          - pattern-inside: function ($REQ, $RES, ...) {...}
          - pattern-inside: function $FUNC($REQ, $RES, ...) {...}
          - pattern-inside: $X = function $FUNC($REQ, $RES, ...) {...}
          - pattern-inside: var $X = function $FUNC($REQ, $RES, ...) {...};
          - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, ...) {...})
      - pattern-either:
          - pattern: |
              $INP = <... $REQ.$PARAM ...>;
              ...
              $RE = new RegExp(<... $INP ...>);
          - pattern: |
              $INP = <... $REQ.$PARAM.$BAR ...>;
              ...
              $RE = new RegExp(<... $INP ...>);
          - pattern: |
              new RegExp(<... $REQ.$PARAM ...>);
          - pattern: |
              new RegExp(<... $REQ.$PARAM.$BAR ...>);
          - pattern: |
              $INP = <... $REQ.$PARAM ...>;
              ...
              $RE = $STR.search(<... $INP ...>);
          - pattern: |
              $INP = <... $REQ.$PARAM.$FOO ...>;
              ...
              $RE = $STR.search(<... $INP ...>);
          - pattern: |
              $STR.search(<... $REQ.$PARAM ...>);
          - pattern: |
              $STR.search(<... $REQ.$PARAM.$BAR ...>);
          - pattern: |
              $INP = <... $REQ.$PARAM ...>;
              ...
              $RE = $STR.match(<... $INP ...>);
          - pattern: |
              $INP = <... $REQ.$PARAM.$FOO ...>;
              ...
              $RE = $STR.match(<... $INP ...>);
          - pattern: |
              $STR.match(<... $REQ.$PARAM ...>);
          - pattern: |
              $STR.match(<... $REQ.$PARAM.$BAR ...>);
          - pattern: |
              $INP = <... $REQ.$PARAM ...>;
              ...
              $RE = $STR.split(<... $INP ...>);
          - pattern: |
              $INP = <... $REQ.$PARAM.$FOO ...>;
              ...
              $RE = $STR.split(<... $INP ...>);
          - pattern: |
              $STR.split(<... $REQ.$PARAM ...>);
          - pattern: |
              $STR.split(<... $REQ.$PARAM.$BAR ...>);
    message: User controlled data in RegExp() can make the application vulnerable to
      layer 7 DoS.
    languages:
      - javascript
    severity: ERROR
    metadata:
      owasp: A01:2017 - Injection
      cwe: "CWE-400: Uncontrolled Resource Consumption"
      category: security
      technology:
        - node.js
        - express
      license: Commons Clause License Condition v1.0[LGPL-2.1-only]