Phy Regex Audit

# Option 1: Audit current directory (auto-detect all source files)
/regex-audit

# Option 2: Specific directory or file
/regex-audit src/
/regex-audit lib/validators.js

# Option 3: Focus on specific language
/regex-audit --lang js
/regex-audit --lang python

# Option 4: Show only CRITICAL and HIGH severity
/regex-audit --min-severity high

# Option 5: Check a single regex pattern for safety
/regex-audit --pattern "^(a+)+"

# Option 6: Focus on HTTP handler files (highest risk)
/regex-audit --high-risk-only

# Option 7: Output machine-readable JSON for CI
/regex-audit --json

python3 -c "
import glob, os
from pathlib import Path

# Language file patterns
patterns = {
    'JavaScript/TypeScript': ['**/*.js', '**/*.ts', '**/*.jsx', '**/*.tsx', '**/*.mjs'],
    'Python':    ['**/*.py'],
    'Go':        ['**/*.go'],
    'Java':      ['**/*.java'],
    'Ruby':      ['**/*.rb'],
    'PHP':       ['**/*.php'],
    'Rust':      ['**/*.rs'],
}

skip_dirs = {'node_modules', '.git', 'dist', 'build', '.next', 'vendor', '__pycache__', '.venv', 'venv'}

all_files = []
for lang, file_patterns in patterns.items():
    lang_files = []
    for p in file_patterns:
        for f in glob.glob(p, recursive=True):
            parts = set(Path(f).parts)
            if not parts & skip_dirs:
                lang_files.append(f)
    if lang_files:
        print(f'{lang}: {len(lang_files)} files')
        all_files.extend(lang_files)

print(f'\\nTotal: {len(all_files)} source files to scan')
"

import re
from pathlib import Path
from dataclasses import dataclass
from typing import Optional

@dataclass
class RegexMatch:
    file: str
    line: int
    pattern: str
    raw_context: str      # the surrounding code line
    language: str
    in_handler: bool      # is this in an HTTP handler / validator?

# Language-specific regex extraction patterns
EXTRACTORS = {
    'js': [
        # Regex literals: /pattern/flags
        re.compile(r'(?<![=!<>])\/([^\/\n\r]{3,}?)\/([gimsuy]*)'),
        # new RegExp("pattern")
        re.compile(r'new\s+RegExp\(["\']([^"\']{3,})["\']'),
        # .test(), .match(), .exec() with string literal
        re.compile(r'\.(?:test|match|exec|replace|search)\(["\'/]([^"\'\/\n]{3,})["\'/]'),
    ],
    'python': [
        # re.compile(r"pattern")
        re.compile(r're\.(?:compile|match|search|fullmatch|findall|finditer|sub|subn|split)\(["\']([^"\']{3,})["\']'),
        re.compile(r're\.(?:compile|match|search|fullmatch|findall|finditer|sub|subn|split)\(r["\']([^"\']{3,})["\']'),
    ],
    'go': [
        # regexp.MustCompile(`pattern`)
        re.compile(r'regexp\.(?:MustCompile|Compile|Match|MatchString)\(["`]([^"`]{3,})["`]'),
    ],
    'java': [
        # Pattern.compile("pattern")
        re.compile(r'Pattern\.compile\(["\']([^"\']{3,})["\']'),
        re.compile(r'\.matches\(["\']([^"\']{3,})["\']'),
    ],
    'ruby': [
        # /pattern/ or Regexp.new("pattern")
        re.compile(r'\/([^\/\n]{3,})\/'),
        re.compile(r'Regexp\.new\(["\']([^"\']{3,})["\']'),
    ],
    'php': [
        # preg_match('/pattern/', ...)
        re.compile(r'preg_(?:match|replace|split|grep)\(["\']([^"\']{3,})["\']'),
    ],
    'rust': [
        # Regex::new(r"pattern")
        re.compile(r'Regex::new\([r]?["\']([^"\']{3,})["\']'),
    ],
}

# Keywords that indicate high-risk call sites
HIGH_RISK_CONTEXTS = [
    'app.get', 'app.post', 'app.put', 'app.delete',
    'router.', 'express', 'fastify', 'koa',
    'validate', 'validator', 'sanitize',
    'request.body', 'req.body', 'req.params', 'req.query',
    'process.argv', 'sys.argv',
    'input(', 'readline(',
    'url.parse', 'new URL(',
    '@app.route', 'flask.request',
    'r.URL.Query', 'r.FormValue',
]

LANG_MAP = {
    '.js': 'js', '.jsx': 'js', '.ts': 'js', '.tsx': 'js', '.mjs': 'js',
    '.py': 'python',
    '.go': 'go',
    '.java': 'java',
    '.rb': 'ruby',
    '.php': 'php',
    '.rs': 'rust',
}


def extract_regexes_from_file(fpath: str) -> list[RegexMatch]:
    """Extract all regex literals from a source file."""
    ext = Path(fpath).suffix.lower()
    lang = LANG_MAP.get(ext)
    if not lang or lang not in EXTRACTORS:
        return []

    try:
        lines = Path(fpath).read_text(encoding='utf-8', errors='replace').splitlines()
    except Exception:
        return []

    results = []
    for line_num, line in enumerate(lines, 1):
        # Check if this line is in a high-risk context (look at surrounding 5 lines)
        context_window = '\n'.join(lines[max(0, line_num-5):line_num+5])
        in_handler = any(kw in context_window for kw in HIGH_RISK_CONTEXTS)

        for extractor in EXTRACTORS[lang]:
            for m in extractor.finditer(line):
                pattern = m.group(1)
                if len(pattern) >= 3:
                    results.append(RegexMatch(
                        file=fpath,
                        line=line_num,
                        pattern=pattern,
                        raw_context=line.strip(),
                        language=lang,
                        in_handler=in_handler,
                    ))

    return results

from enum import Enum

class Severity(Enum):
    CRITICAL = 4   # Exponential backtracking — proven DoS vector
    HIGH = 3       # Polynomial backtracking — slow on long inputs
    MEDIUM = 2     # Potentially slow — context-dependent
    LOW = 1        # Style/quality issue

@dataclass
class ReDoSFinding:
    regex_match: RegexMatch
    severity: Severity
    vulnerability_type: str
    dangerous_subpattern: str
    description: str
    attack_input_example: str
    fix_suggestion: str


# ReDoS pattern signatures
REDOS_PATTERNS = [

    # ===== CRITICAL: Exponential Backtracking =====

    {
        'name': 'NESTED_QUANTIFIERS',
        'severity': Severity.CRITICAL,
        'detector': re.compile(r'\(([^()]{1,30}\+[^()]{0,10})\)\+|\(([^()]{1,30}\*[^()]{0,10})\)\+'),
        'description': 'Nested quantifiers (a+)+ or (a*)+ create exponential backtracking.',
        'attack_shape': 'Long string of matching chars followed by one non-matching char',
        'example_attack': '"aaaaaaaaaaaaaaaaaaaaaaaaaX"',
        'fix': 'Use atomic group (?>...) or possessive quantifier — rewrite to remove nesting.',
    },
    {
        'name': 'NESTED_STAR_PLUS',
        'severity': Severity.CRITICAL,
        'detector': re.compile(r'\(([^()]{1,30})\)\*\+|\(([^()]{1,30})\)\+\*'),
        'description': 'Nested star/plus combination enables exponential path explosion.',
        'attack_shape': 'Repeated matching chars followed by failure',
        'example_attack': '"aaaaaaaaaaaX"',
        'fix': 'Flatten quantifiers or use possessive quantifiers.',
    },

    # ===== HIGH: Polynomial Backtracking =====

    {
        'name': 'ALTERNATION_OVERLAP',
        'severity': Severity.HIGH,
        'detector': re.compile(r'\(([a-zA-Z]{1,5})\|([a-zA-Z]{1,5})\)\+|\(([a-zA-Z]{1,5})\|([a-zA-Z]{1,5})\)\*'),
        'description': 'Overlapping alternation with quantifier: (ab|a)+ causes polynomial backtracking.',
        'attack_shape': 'Long string that partially matches both alternatives',
        'example_attack': '"ababababababababX"',
        'fix': 'Reorder alternatives longest-first; avoid overlapping prefixes. Use (?>a(?:b)?)+ instead of (ab|a)+',
    },
    {
        'name': 'GREEDY_DOTSTAR_ANCHORED',
        'severity': Severity.HIGH,
        'detector': re.compile(r'\.\*.*\.\*'),
        'description': 'Multiple .* in sequence causes O(n²) backtracking on non-matching inputs.',
        'attack_shape': 'Long string that partially matches then fails at the end',
        'example_attack': '"a" * 10000 + "X"',
        'fix': 'Use [^\\n]* instead of .* when newlines are impossible; add anchors.',
    },

    # ===== MEDIUM: Potentially Slow =====

    {
        'name': 'UNBOUNDED_REPETITION_COMPLEX',
        'severity': Severity.MEDIUM,
        'detector': re.compile(r'\([^()]{5,}\)\{[0-9,]+\}'),
        'description': 'Large repetition count on complex group — can be slow on long non-matching inputs.',
        'attack_shape': 'Input that triggers maximum iterations before failing',
        'example_attack': 'Input matching N-1 repetitions but failing on last character',
        'fix': 'Add possessive quantifier or reduce repetition scope.',
    },
    {
        'name': 'MISSING_ANCHORS',
        'severity': Severity.MEDIUM,
        'detector': None,  # Checked separately
        'description': 'Regex without ^ or $ anchors on email/URL patterns causes full-text search instead of match.',
        'attack_shape': 'Input containing valid pattern embedded in garbage',
        'example_attack': '"evil.com/redirect?to=legit.com"',
        'fix': 'Add ^ at start and $ at end: /^pattern$/',
    },
]


def analyze_regex_for_redos(rm: RegexMatch) -> list[ReDoSFinding]:
    """Check a single regex for ReDoS vulnerabilities."""
    findings = []
    pattern = rm.pattern

    for sig in REDOS_PATTERNS:
        if sig['detector'] is None:
            continue
        match = sig['detector'].search(pattern)
        if match:
            findings.append(ReDoSFinding(
                regex_match=rm,
                severity=sig['severity'],
                vulnerability_type=sig['name'],
                dangerous_subpattern=match.group(0),
                description=sig['description'],
                attack_input_example=sig.get('example_attack', ''),
                fix_suggestion=sig['fix'],
            ))

    # Check for missing anchors on patterns that look like email/URL/phone validators
    looks_like_validator = any(
        kw in rm.raw_context.lower()
        for kw in ['email', 'url', 'phone', 'validate', 'isValid', 'check']
    )
    if looks_like_validator and not (pattern.startswith('^') or pattern.endswith('$')):
        findings.append(ReDoSFinding(
            regex_match=rm,
            severity=Severity.MEDIUM,
            vulnerability_type='MISSING_ANCHORS',
            dangerous_subpattern=pattern[:40],
            description='Validator regex lacks ^ and $ anchors — matches anywhere in string.',
            attack_input_example='"garbage_validinput_garbage"',
            fix_suggestion=f'Add anchors: /^{pattern[:40]}$/',
        ))

    return findings


def check_locale_assumptions(rm: RegexMatch) -> Optional[ReDoSFinding]:
    """Detect ASCII-only character classes that should be locale-aware."""
    ASCII_ONLY_HINTS = [
        (re.compile(r'\[a-zA-Z\]|\[a-z\]|\[A-Z\]'), 'Matches only ASCII letters — fails on é, ü, ñ, etc.'),
        (re.compile(r'\[0-9\]'), 'Use \\d or [0-9] explicitly; be aware \\d matches Unicode digits in some engines'),
    ]
    for detector, msg in ASCII_ONLY_HINTS:
        if detector.search(rm.pattern):
            return ReDoSFinding(
                regex_match=rm,
                severity=Severity.LOW,
                vulnerability_type='LOCALE_ASSUMPTION',
                dangerous_subpattern=detector.search(rm.pattern).group(0),
                description=f'ASCII-only character class: {msg}',
                attack_input_example='"Ångström" or "naïve"',
                fix_suggestion='Use \\p{L} (Unicode letter) if your regex engine supports it, or explicitly list the characters you need.',
            )
    return None

import os
import glob

def run_regex_audit(target_dir='.', min_severity=Severity.LOW, high_risk_only=False):
    """Full scan: discover files, extract regexes, analyze, report."""

    # Discover files
    all_files = []
    for ext in ['.js', '.jsx', '.ts', '.tsx', '.mjs', '.py', '.go', '.java', '.rb', '.php', '.rs']:
        pattern = f'{target_dir}/**/*{ext}'
        for f in glob.glob(pattern, recursive=True):
            if not any(skip in f for skip in ['node_modules', '.git', 'dist', 'build', '.next', 'vendor']):
                all_files.append(f)

    # Extract and analyze
    all_findings = []
    total_regexes = 0

    for fpath in all_files:
        regexes = extract_regexes_from_file(fpath)
        total_regexes += len(regexes)

        for rm in regexes:
            if high_risk_only and not rm.in_handler:
                continue

            findings = analyze_regex_for_redos(rm)
            locale_finding = check_locale_assumptions(rm)
            if locale_finding:
                findings.append(locale_finding)

            for f in findings:
                if f.severity.value >= min_severity.value:
                    all_findings.append(f)

    # Sort by severity desc, then file
    all_findings.sort(key=lambda x: (-x.severity.value, x.regex_match.file, x.regex_match.line))

    return all_findings, total_regexes, len(all_files)

## ReDoS & Regex Security Audit
Project: my-app | Files scanned: 847 | Regexes found: 214

---

### Summary

| Severity | Count | Description |
|----------|-------|-------------|
| 🔴 CRITICAL | 2 | Exponential backtracking — proven DoS vector |
| 🟠 HIGH | 4 | Polynomial backtracking — slow on long inputs |
| 🟡 MEDIUM | 7 | Potentially slow or logic error |
| ⚪ LOW | 11 | Style/locale issues |

**⚠️ 3 findings are in HTTP request handlers — prioritize these.**

---

### 🔴 CRITICAL — Exponential Backtracking

**#1 — src/middleware/auth.js:47**
```js
// Context: JWT token format validator in Express middleware
app.use('/api', (req, res, next) => {
    const token = req.headers.authorization
    if (!/^([a-zA-Z0-9_-]+\.)+[a-zA-Z0-9_-]+$/.test(token)) { ... }

// Before (vulnerable):
/^([a-zA-Z0-9_-]+\.)+[a-zA-Z0-9_-]+$/

// After (safe):
// Option 1: Possessive quantifier (not supported in JS — use atomic group via lookbehind trick)
// Option 2: Rewrite without nested quantifiers:
/^[a-zA-Z0-9_-]+(?:\.[a-zA-Z0-9_-]+)+$/
// This eliminates the nested quantifier — the outer group cannot backtrack
// into positions already consumed by the inner match.

const EMAIL_RE = /^(([^<>()\[\]\\.,;:\s@"]+(\.[^<>()\[\]\\.,;:\s@"]+)*)|(".+"))@/

// Use a proven safe email regex:
const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
// For strict RFC 5322: use the validator.js library (pre-audited, safe)
// npm install validator → isEmail(str)

// URL parameter parser
const queryRe = /.*id=.*&.*/

// Before:
/.*id=.*&.*/
// After (anchored, no double .* scan):
/(?:^|&)id=([^&]+)/

const PHONE_RE = /\+?[0-9]{10,15}/   // used in: validatePhone(userInput)

const PHONE_RE = /^\+?[0-9]{10,15}$/