vendredi 7 octobre 2022

SonarQube: denial of service for regex pattern due to polynomial runtime backtracking

I am using a regex pattern to validate an email. SonarQube is giving "Make sure the regex used here,which is vulnerable to polynomial runtime due to backtracking, cannot lead to denial of service".

The code looks like below

private static Pattern pattern = Pattern.compile("^.+@.+(\\.[^.]+)++$");
return pattern.matcher(email).matches();

Tried some patterns but could'nt get desired result.

It is very important that current behaviour of pattern matching should not break.

Please help me with this regex pattern improvisation that should not break my code.

Thanks in advance.

Aucun commentaire:

Enregistrer un commentaire