Skip to content

Commit a49999d

Browse files
committed
PolynomialReDoS: disable diff-informed support
This is because it was failing the diff-informed consistency check, and like other ReDoS queries (Python?) the query tries to be helpful by showing a substring of a regex, which has a `hasLocation(...)` (intensional) but no corresponding `getLocation()` (extensional). Until the location overrides get updated to support `hasLocation`-based locations, it's probably best to turn off diff-informed support.
1 parent b2cb585 commit a49999d

File tree

1 file changed

+0
-12
lines changed

1 file changed

+0
-12
lines changed

java/ql/lib/semmle/code/java/security/regexp/PolynomialReDoSQuery.qll

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -47,18 +47,6 @@ module PolynomialRedosConfig implements DataFlow::ConfigSig {
4747
node instanceof SimpleTypeSanitizer or
4848
node.asExpr().(MethodCall).getMethod() instanceof LengthRestrictedMethod
4949
}
50-
51-
predicate observeDiffInformedIncrementalMode() { any() }
52-
53-
Location getASelectedSinkLocation(DataFlow::Node sink) {
54-
exists(SuperlinearBackTracking::PolynomialBackTrackingTerm regexp |
55-
regexp.getRootTerm() = sink.(PolynomialRedosSink).getRegExp()
56-
|
57-
result = sink.getLocation()
58-
or
59-
result = regexp.getLocation()
60-
)
61-
}
6250
}
6351

6452
module PolynomialRedosFlow = TaintTracking::Global<PolynomialRedosConfig>;

0 commit comments

Comments
 (0)