regexploit

library1.0.0pypypi✓ verified 82d ago

Regexploit is a Python library designed to identify Regular Expression Denial of Service (ReDoS) vulnerabilities in regular expressions. It analyzes a given regex string to determine if it can be exploited by crafted input, potentially leading to excessive backtracking and application slowdowns or crashes. The current version is 1.0.0, and releases appear to be infrequent, focusing on stable major versions.

testing

pip install regexploit

github ↗package ↗

INSTALL

IMPORT

SIG · REGEXPLOIT

regexploit

testingpythonv1.0.0

Install

1.6s avg

Import

—

Disk

16MB

Pass rate

10/ 10

Env Coverage10 / 10

glibc

3.9–3.13

musl

3.9–3.13

Install & Compatibility

Where this runs

tested against v1.0.0 · pip install

no network on importno background threads

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

py 3.10–3.920 runs

installs and imports cleanly · install 0.0s · import 0.000s · 18.2MB

glibc

py 3.10–3.920 runs

installs and imports cleanly · install 1.6s · import 0.000s · 19MB

16MB installed

● package 16MB

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

Regexploit

✓ import regexploit

✗ from regexploit import Regexploit

This quickstart demonstrates how to instantiate the Regexploit class with a regex pattern and check it for ReDoS vulnerabilities. It prints detailed findings if a vulnerability is detected, using the `to_dict()` method for structured output.

from regexploit.regexploit import Regexploit import json # Define a potentially vulnerable regex pattern regex_pattern = r"^(a+)+$" # Initialize the Regexploit engine with the pattern # It's recommended to set a timeout to prevent excessively long analysis exploit = Regexploit(regex_pattern, timeout=5) # Check the regex for ReDoS vulnerabilities result = exploit.check() # Process and display the results if result.is_vulnerable(): print(f"The regex '{regex_pattern}' is potentially vulnerable to ReDoS.") print("Vulnerability Details:") print(json.dumps(result.to_dict(), indent=2)) else: print(f"The regex '{regex_pattern}' appears to be safe from common ReDoS patterns.")

regexploit --version

Debug

Known issues

gotchaAnalyzing complex or very long regexes can be computationally intensive and time-consuming. By default, Regexploit does not impose a timeout.

fix

Always pass a `timeout` argument (in seconds) to the `Regexploit` constructor, e.g., `Regexploit(regex, timeout=10)`. This prevents the check from running indefinitely.

affects: >=1.0.0

gotchaRegexploit expects regex strings that are valid according to Python's `re` module syntax. Invalid regex patterns will cause `_sre.error` or other exceptions.

fix

Ensure your regex string is syntactically correct and properly escaped (e.g., use raw strings `r"..."`) before passing it to `Regexploit`.

affects: >=1.0.0

gotchaWhile powerful, Regexploit is a static analysis tool that identifies *potential* ReDoS vulnerabilities. It may not detect all possible exploitation vectors, and false negatives are possible.

fix

Treat Regexploit's results as strong indicators rather than definitive proofs. For critical applications, manual security review and dynamic testing are still recommended alongside automated tools.

affects: >=1.0.0

Upgrade

Version history

1.0.0latest on PyPI · released Mar 11, 2021

Audit

Dependencies

No dependency data recorded yet.

Agent activity

13 hits · last 30 days

node

Resources

githubhttps://github.com/doyensec/regexploit ↗

packagehttps://pypi.org/project/regexploit/ ↗