05 May 10
Protecting against Regex DOS attacks
Bryan Sullivan describes in the May issue of his MSDN article a denial of service attack that abuses regular expressions. As Bryan explains, a poorly written regex can bring your server to its knees.
Bryan demonstrates that even the simplest regular expressions can bring your server to its knees. Here are some examples of regular expressions that can easily cause this to happen:
^(\d+)+$
^(\d+)*$
^(\d*)*$
^(\d+|\s+)*$
^(\d|\d\d)+$
^(\d|\d?)+$
Read more about the causes and the cures here.
- .NET General, Security - No comments / No trackbacks - § ¶
The code samples on my weblog are colorized using javascript, but
you disabled javascript (for my website) on your browser.
If you're interested in viewing the posted code snippets in
color, please enable javascript.
