Unsafe Regex pattern

[idleberg]

According to tjenkinson/eslint-plugin-redos-detector, the ECMAScript-compatible RegExp provided in the FAQ-section of the website is unsafe.

Regex is not safe. There could be infinite backtracks.
The following trails show how the same input can be matched multiple ways.
  2: `0`  |  2: `0`
 13: `\.` | 13: `\.`
 16: `0`  | 16: `0`
 27: `\.` | 27: `\.`
 30: `0`  | 30: `0`
 44: `-`  | 44: `-`
 49: `0`  | 49: `0`
 89: `\.` | 89: `\.`
105: `\d` | 94: `0`
====================
  2: `0`  |   2: `0`
 13: `\.` |  13: `\.`
 16: `0`  |  16: `0`
 27: `\.` |  27: `\.`
 30: `0`  |  30: `0`
 44: `-`  |  44: `-`
 49: `0`  |  49: `0`
 89: `\.` |  89: `\.`
105: `\d` |  96: `[1-9]`
105: `\d` | 101: `\d`
========================
 2: `0`  |  2: `0`
13: `\.` | 13: `\.`
16: `0`  | 16: `0`
27: `\.` | 27: `\.`
30: `0`  | 30: `0`
44: `-`  | 44: `-`
60: `\d` | 49: `0`
===================
  2: `0`     |  2: `0`
 13: `\.`    | 13: `\.`
 16: `0`     | 16: `0`
 27: `\.`    | 27: `\.`
 30: `0`     | 30: `0`
 44: `-`     | 44: `-`
 51: `[1-9]` | 51: `[1-9]`
 89: `\.`    | 89: `\.`
105: `\d`    | 94: `0`
==========================
  2: `0`     |   2: `0`
 13: `\.`    |  13: `\.`
 16: `0`     |  16: `0`
 27: `\.`    |  27: `\.`
 30: `0`     |  30: `0`
 44: `-`     |  44: `-`
 51: `[1-9]` |  51: `[1-9]`
 89: `\.`    |  89: `\.`
105: `\d`    |  96: `[1-9]`
105: `\d`    | 101: `\d`
===========================
  2: `0`     |  2: `0`
 13: `\.`    | 13: `\.`
 16: `0`     | 16: `0`
 27: `\.`    | 27: `\.`
 30: `0`     | 30: `0`
 44: `-`     | 44: `-`
 51: `[1-9]` | 51: `[1-9]`
 56: `\d`    | 56: `\d`
 89: `\.`    | 89: `\.`
105: `\d`    | 94: `0`
==========================
  2: `0`     |   2: `0`
 13: `\.`    |  13: `\.`
 16: `0`     |  16: `0`
 27: `\.`    |  27: `\.`
 30: `0`     |  30: `0`
 44: `-`     |  44: `-`
 51: `[1-9]` |  51: `[1-9]`
 56: `\d`    |  56: `\d`
 89: `\.`    |  89: `\.`
105: `\d`    |  96: `[1-9]`
105: `\d`    | 101: `\d`
===========================
 2: `0`  |  2: `0`
13: `\.` | 13: `\.`
16: `0`  | 16: `0`
27: `\.` | 27: `\.`
30: `0`  | 30: `0`
44: `-`  | 44: `-`
60: `\d` | 51: `[1-9]`
60: `\d` | 56: `\d`
======================
  2: `0`         |  2: `0`
 13: `\.`        | 13: `\.`
 16: `0`         | 16: `0`
 27: `\.`        | 27: `\.`
 30: `0`         | 30: `0`
 44: `-`         | 44: `-`
 63: `[a-zA-Z-]` | 63: `[a-zA-Z-]`
 89: `\.`        | 89: `\.`
105: `\d`        | 94: `0`
==================================
  2: `0`         |   2: `0`
 13: `\.`        |  13: `\.`
 16: `0`         |  16: `0`
 27: `\.`        |  27: `\.`
 30: `0`         |  30: `0`
 44: `-`         |  44: `-`
 63: `[a-zA-Z-]` |  63: `[a-zA-Z-]`
 89: `\.`        |  89: `\.`
105: `\d`        |  96: `[1-9]`
105: `\d`        | 101: `\d`
===================================
  2: `0`            |  2: `0`
 13: `\.`           | 13: `\.`
 16: `0`            | 16: `0`
 27: `\.`           | 27: `\.`
 30: `0`            | 30: `0`
 44: `-`            | 44: `-`
 63: `[a-zA-Z-]`    | 63: `[a-zA-Z-]`
 72: `[0-9a-zA-Z-]` | 72: `[0-9a-zA-Z-]`
 89: `\.`           | 89: `\.`
105: `\d`           | 94: `0`
========================================
  2: `0`            |   2: `0`
 13: `\.`           |  13: `\.`
 16: `0`            |  16: `0`
 27: `\.`           |  27: `\.`
 30: `0`            |  30: `0`
 44: `-`            |  44: `-`
 63: `[a-zA-Z-]`    |  63: `[a-zA-Z-]`
 72: `[0-9a-zA-Z-]` |  72: `[0-9a-zA-Z-]`
 89: `\.`           |  89: `\.`
105: `\d`           |  96: `[1-9]`
105: `\d`           | 101: `\d`
=========================================
  2: `0`         |  2: `0`
 13: `\.`        | 13: `\.`
 16: `0`         | 16: `0`
 27: `\.`        | 27: `\.`
 30: `0`         | 30: `0`
 44: `-`         | 44: `-`
 60: `\d`        | 60: `\d`
 63: `[a-zA-Z-]` | 63: `[a-zA-Z-]`
 89: `\.`        | 89: `\.`
105: `\d`        | 94: `0`
==================================
  2: `0`         |   2: `0`
 13: `\.`        |  13: `\.`
 16: `0`         |  16: `0`
 27: `\.`        |  27: `\.`
 30: `0`         |  30: `0`
 44: `-`         |  44: `-`
 60: `\d`        |  60: `\d`
 63: `[a-zA-Z-]` |  63: `[a-zA-Z-]`
 89: `\.`        |  89: `\.`
105: `\d`        |  96: `[1-9]`
105: `\d`        | 101: `\d`
===================================
  2: `0`            |  2: `0`
 13: `\.`           | 13: `\.`
 16: `0`            | 16: `0`
 27: `\.`           | 27: `\.`
 30: `0`            | 30: `0`
 44: `-`            | 44: `-`
 60: `\d`           | 60: `\d`
 63: `[a-zA-Z-]`    | 63: `[a-zA-Z-]`
 72: `[0-9a-zA-Z-]` | 72: `[0-9a-zA-Z-]`
 89: `\.`           | 89: `\.`
105: `\d`           | 94: `0`
========================================
Hit maximum number of steps so there may be more results than shown here.
There are more results than this but hit results limit.

Result on ReDos Detector

[idleberg]

The semver-regex package on npm uses a different Regex pattern, but its README has a disclaimer text that might also apply to the official Regex on the Semver website:

I do not consider ReDoS a valid vulnerability for this package. It's simply not possible to make it fully ReDoS safe. It's up to the user to set a timeout for the regex if they accept untrusted user input.

via https://www.npmjs.com/package/semver-regex

If that's the case, feel free to close this issue!