Regular Expression Denial of Service (ReDoS)

// Node.js/Express - Secure regex handling to prevent ReDoS

// SECURE: Never compile untrusted regex - escape user input as literal
app.post('/api/search', authenticateToken, async (req, res) => {
  const userInput = req.body.pattern;
  const searchText = req.body.text;
  
  // SECURE: Input size limits
  if (!userInput || userInput.length > 64) {
    return res.status(400).json({ error: 'Pattern too long (max 64 chars)' });
  }
  
  if (!searchText || searchText.length > 10000) {
    return res.status(400).json({ error: 'Text too long (max 10KB)' });
  }
  
  try {
    // SECURE: Escape user input as literal string, not regex pattern!
    // This treats special characters (.*+?[]{}|) as literals
    const escapedPattern = userInput.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
    
    // Now it's safe to create a regex
    const regex = new RegExp(escapedPattern, 'gi');
    const matches = searchText.match(regex);
    
    res.json({
      found: matches ? matches.length : 0,
      matches: matches ? matches.slice(0, 100) : []  // Limit results
    });
  } catch (err) {
    res.status(400).json({ error: 'Invalid search pattern' });
  }
});

// SECURE: Alternative approach - provide a safe query DSL instead of regex
app.post('/api/search-safe', authenticateToken, (req, res) => {
  const { terms, operator } = req.body;  // terms: ['word1', 'word2'], operator: 'AND'|'OR'
  const searchText = req.body.text;
  
  if (!Array.isArray(terms) || terms.length === 0 || terms.length > 10) {
    return res.status(400).json({ error: 'Invalid terms (1-10 allowed)' });
  }
  
  // SECURE: Build safe pattern from validated terms
  const safeTerms = terms
    .filter(t => typeof t === 'string' && t.length <= 50)
    .map(t => t.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'));  // Escape each term
  
  if (operator === 'AND') {
    // Check all terms present (using simple indexOf)
    const allFound = safeTerms.every(term => searchText.toLowerCase().includes(term.toLowerCase()));
    res.json({ found: allFound });
  } else {
    // OR: check any term present
    const anyFound = safeTerms.some(term => searchText.toLowerCase().includes(term.toLowerCase()));
    res.json({ found: anyFound });
  }
});

// SECURE: Email validation with simple, safe regex
app.post('/api/validate-email', (req, res) => {
  const email = req.body.email;
  
  // Input length check
  if (!email || email.length > 254) {
    return res.status(400).json({ valid: false, error: 'Email too long' });
  }
  
  // SECURE: Simple regex without nested quantifiers or backtracking
  // This uses + instead of * and avoids nesting
  const emailRegex = /^[a-zA-Z0-9_\-\.]+@[a-zA-Z0-9_\-\.]+\.[a-zA-Z]{2,10}$/;
  
  const isValid = emailRegex.test(email);
  res.json({ valid: isValid });
});

// SECURE: Alternative - use a proper email validation library
const validator = require('validator');

app.post('/api/validate-email-safe', (req, res) => {
  const email = req.body.email;
  
  if (!email || email.length > 254) {
    return res.status(400).json({ valid: false });
  }
  
  // SECURE: Use battle-tested library instead of custom regex
  const isValid = validator.isEmail(email, {
    allow_utf8_local_part: false,
    require_tld: true
  });
  
  res.json({ valid: isValid });
});

// SECURE: If you MUST allow user-defined patterns, use RE2 (linear-time regex)
const RE2 = require('re2');

app.post('/api/advanced-search', authenticateToken, rateLimiter, (req, res) => {
  const userPattern = req.body.pattern;
  const searchText = req.body.text;
  
  // SECURE: Strict input limits
  if (!userPattern || userPattern.length > 100) {
    return res.status(400).json({ error: 'Pattern too long' });
  }
  
  if (!searchText || searchText.length > 50000) {
    return res.status(400).json({ error: 'Text too long' });
  }
  
  try {
    // SECURE: RE2 uses linear-time matching (no backtracking)
    // Even malicious patterns like (a+)+ won't cause exponential behavior
    const regex = new RE2(userPattern, 'g');
    
    // SECURE: Additional safeguard - limit match iterations
    const matches = [];
    let match;
    let count = 0;
    const MAX_MATCHES = 1000;
    
    while ((match = regex.exec(searchText)) !== null && count < MAX_MATCHES) {
      matches.push(match[0]);
      count++;
    }
    
    res.json({
      found: matches.length,
      matches: matches.slice(0, 100),  // Return max 100 matches
      truncated: matches.length >= MAX_MATCHES
    });
  } catch (err) {
    res.status(400).json({ error: 'Invalid regex pattern' });
  }
});

// SECURE: Request-level timeout to prevent DoS
const timeout = require('connect-timeout');

app.use('/api/*', timeout('5s'));  // 5 second timeout for all API requests

app.use((req, res, next) => {
  if (req.timedout) {
    return res.status(503).json({ error: 'Request timeout' });
  }
  next();
});

// SECURE: Rate limiting to prevent repeated ReDoS attempts
const rateLimit = require('express-rate-limit');

const searchLimiter = rateLimit({
  windowMs: 1 * 60 * 1000,  // 1 minute
  max: 20,  // Max 20 searches per minute per IP
  message: { error: 'Too many search requests, please try again later' }
});

app.use('/api/search*', searchLimiter);