ReDoS Sandbox & Safety Tester
Analyze regular expression syntax statically for vulnerability indicators, and test performance payloads safely in isolated threads.
Backtracking Diagnostics
No RunStatic Heuristics Report
Engine Architecture Compatibility
Understanding Catastrophic Backtracking & ReDoS
Regular Expression Denial of Service (ReDoS) is a severe vulnerability class where an NFA (Nondeterministic Finite Automaton) regex engine is forced into catastrophic backtracking. This occurs when an ambiguous pattern with repeating nested loops (e.g., ^(a+)+$) fails to match an input containing a slightly divergent trailing character (e.g., aaaaaX). The engine evaluates every mathematical permutation of partitions, causing execution steps to scale exponentially relative to input length. Consequently, a single, tiny request can saturate a server CPU entirely. This tool parses patterns for static structural risks, and utilizes an isolated worker sandbox to measure runtime safely.
Key Features
- Run diagnostics using thread-isolated Web Workers to safeguard the main thread from freeze issues.
- Instantly evaluate regular expression structures for nested quantifiers and ambiguous wildcards.
- Integrated standard evil regex presets to demonstrate exponential evaluation timelines safely.
- Provides immediate execution speed feedback with high-resolution performance timers.
- Entirely client-side architecture ensuring zero search query data is stored or transmitted.
Frequently Asked Questions
What is catastrophic backtracking?
Catastrophic backtracking is an execution state where a regex engine is forced to evaluate an exponential number of possible matching paths. When a pattern contains nested repetition (like a loop inside a loop) and the input string nearly matches but fails at the very end, the engine has to step backward and test every partition combination, causing CPU utilization to spike to 100%.
Why does this tool use a Web Worker?
Executing a vulnerable regex on a malicious input in standard JavaScript freezes the main thread, locking up the entire browser UI. By spawning the regex test inside an isolated Web Worker, the calculation executes on a background thread. If the test hangs, our timeout handler terminates the worker thread, leaving your browser fully responsive.
How do I fix a ReDoS-vulnerable regex?
You can eliminate ReDoS vulnerabilities by removing ambiguity. Avoid nested repetitions (like loops inside loops), limit unbounded wildcards, and define strict anchor boundaries (^ and $). For complex validations (like emails), prefer robust parsing libraries rather than giant, complex regular expressions.
Do all regex engines suffer from ReDoS?
No. Engines based on NFAs (found in JavaScript, Python, Java, and .NET) backtracking-evaluate patterns and are susceptible. Engines based on DFAs (Deterministic Finite Automata) or linear engines like Google's RE2 evaluate matches in linear time relative to input length and are mathematically immune to catastrophic backtracking.