Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Large bounded quantifier generates single-character attack strings #1310

Open
nisbet-hubbard opened this issue Sep 8, 2024 · 0 comments
Open

Large bounded quantifier generates single-character attack strings #1310

nisbet-hubbard opened this issue Sep 8, 2024 · 0 comments

Comments

@nisbet-hubbard
Copy link

nisbet-hubbard commented Sep 8, 2024 •
edited
Loading

What is the problem?

Using the GUI at Devina.io (as the Playground appears to be down), a regex with large bound quantifiers such as [a-z0-9]{2000,} currently generates artificial attack strings like '00000000' + '00000000000000000000000000000'.repeat(29) + '000000000000000000000000000' + '0000000'.repeat(27) or '00000'.repeat(352) + '000000000000000000000000000000000' and gets reported as polynomial.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@nisbet-hubbard