The software specifies a regular expression in a way that causes data to be improperly matched or compared.
Extended Description
When the regular expression is used in protection mechanisms such as filtering or validation, this may allow an attacker to bypass the intended restrictions on the incoming data.
Time of Introduction
Implementation
Applicable Platforms
Languages
All
Common Consequences
Scope
Effect
Access Control
Technical Impact: Bypass protection
mechanism
In PHP, regular expression checks can sometimes be bypassed with a
null byte, leading to any number of weaknesses.
Regular expressions can become error prone when defining a complex
language even for those experienced in writing grammars. Determine if
several smaller regular expressions simplifies one large regular
expression. Also, subject your regular expression to thorough testing
techniques such as equivalence partitioning, boundary value analysis,
and robustness. After testing and a reasonable confidence level is
achieved a regular expression may not be full proof. If an exploit is
allowed to slip through, then record the exploit and refactor your
regular expression.
Other Notes
Keywords: regexp
This can seem to overlap whitelist/blacklist problems, but it is intended
to deal with improperly written regular expressions, regardless of the
values that those regular expressions use. While whitelists and blacklists
are often implemented using regular expressions, they can be implemented
using other mechanisms as well.
Regexp errors are likely a primary factor in many MFVs, especially those
that require multiple manipulations to exploit. However, they are rarely
diagnosed at this level of detail.
[REF-11] M. Howard and
D. LeBlanc. "Writing Secure Code". Chapter 10, "Using Regular Expressions for Checking Input"
Page 350. 2nd Edition. Microsoft. 2002.
Description
