https://github.com/zhibirc/redos
ReDoS in Node.js land with demo, side notes and fun.
https://github.com/zhibirc/redos
Last synced: 9 months ago
JSON representation
ReDoS in Node.js land with demo, side notes and fun.
- Host: GitHub
- URL: https://github.com/zhibirc/redos
- Owner: zhibirc
- License: mit
- Created: 2023-02-26T18:08:41.000Z (over 3 years ago)
- Default Branch: master
- Last Pushed: 2023-04-23T17:15:25.000Z (about 3 years ago)
- Last Synced: 2024-04-16T17:27:45.689Z (about 2 years ago)
- Language: JavaScript
- Size: 1.03 MB
- Stars: 0
- Watchers: 2
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: readme.md
- License: license.md
Awesome Lists containing this project
README
# ReDoS
ReDoS in Node.js land with demo, side notes and fun.
## Usage
```shell
# node index.js CHARACTER_LIST [DELAY]
# where CHARACTER_LIST is JSON Array and DELAY is number of milliseconds
node index.js '["a", "([a-z]+)"]'
```
## Testing algorithm
1. Start from the entrypoint described in [usage](#usage) section with mandatory **character list** and **optional delay**.
2. If **delay** number of milliseconds was given then use it, otherwise use delay of **120** seconds.
3. Check for CPU cores number to setting up parallel execution.
4. Also validate for arguments and if **character list** is absent or malformed throw an error.
5. Generate all possible valid regular expressions from given character list and meta-characters `(`, `)`, `|`, `+`, `*`.
6. Generate random string from given alphabet characters of length **20** (default) with one different symbol at the end.
7. For each thread create a Promise-based job which have the following responsibility:
- fork worker process and add it to worker pool
- listen for message (IPC) from corresponding worker and do the following:
- save given statistics
- if there are no regular expressions for matching (nothing to do) kill this worker and resolve the job
- otherwise send to worker new portion of data to handle
8. Send portion of data to handle to each worker in worker pool to start computations.
9.