Semgrep: Match inside JS regex

[ajinabraham]

https://semgrep.live/kjO?version=experimental

How do I match inside JS regex?

[ievans]

Hi @ajinabraham ! Are you familiar with the regex syntax for finding strings inside code: https://github.com/returntocorp/semgrep/blob/develop/docs/pattern-features.md#strings ? Just checking before I dig in.

[ajinabraham]

@ievans Yes I am familiar. I am trying to match a special case where a regex is constructed with user input.

/^([a-zA-Z0-9_\.\-])+\@/ + user_input + /(([a-zA-Z0-9\-])+\.)+([a-zA-Z0-9]{2,4})+$/.test('aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa');

[ievans]

Ah, as I see it, semgrep is not interpreting the regex as a string literal, so the string literal syntax matching doesn't work.

[dlukeomalley]

@ajinabraham What's the relative priority of this ticket versus some of the others you've filed? We're gearing up for our next 2-week sprint and want to tackle the highest priority items for you. Thanks!

[ajinabraham]

I would say medium again. This blocks me from adding a rule that can check for regular expression DoS.

[nbrahms]

Fixed in 0.10