@codemod/replace-vulnerable-regex-patterns

Name: replace-vulnerable-regex-patterns codemod
Availability: InStock

Identify and replace regex patterns vulnerable to ReDoS (Regular Expression Denial of Service) attacks in JavaScript and TypeScript codebases.

About ReDoS Vulnerabilities

Regular Expression Denial of Service (ReDoS) attacks exploit vulnerable regex patterns to cause exponential backtracking, leading to:

Application freezing or crashing
Excessive CPU consumption
Denial of service to legitimate users

This codemod automatically detects and replaces common vulnerable patterns with safe alternatives while maintaining functionality.

Security References

CWE-1333: Inefficient Regular Expression Complexity
OWASP: Regular Expression DoS Prevention Cheat Sheet
CVE Examples: CVE-2019-16769, CVE-2020-7662, CVE-2021-23382

Installation

bash

Usage

This codemod automatically transforms vulnerable regex patterns in JavaScript/TypeScript files:

Supported Patterns

Nested Quantifiers

javascript

Exponential Backtracking

javascript

Complex Email Validation

javascript

Alternation with Duplicates

javascript

Nested Groups with Quantifiers

javascript

RegExp Constructor Support

The codemod also handles RegExp constructor patterns:

javascript

What Gets Transformed

✅ Regex literals: /pattern/flags
✅ RegExp constructor: new RegExp('pattern', 'flags')
✅ RegExp function: RegExp('pattern', 'flags')
✅ Template literals with regex patterns
✅ Object properties containing regex
✅ Function parameters with regex defaults

What Stays Unchanged

❌ Already safe patterns
❌ Optimized patterns with atomic groups (?>...)
❌ Possessive quantifiers *+, ++, ?+
❌ Patterns in comments (documentation examples)
❌ Test files (preserved for security testing)
❌ Third-party library code

File Support

JavaScript (.js)
TypeScript (.ts)
JSX (.jsx)
TSX (.tsx)

Safety Features

Non-destructive: Only transforms known vulnerable patterns
Functionality preserved: Replacements maintain matching behavior
Comment preservation: Documentation examples remain unchanged
Test file exclusion: Security test cases are not modified
Already-optimized detection: Skips patterns with atomic groups

Examples

Before Transformation

javascript

After Transformation

javascript

Development

bash

Contributing

Add new vulnerable patterns to getSafePattern() function
Create test cases in tests/ directory
Run tests to ensure functionality
Update README with new pattern examples

Limitations

Pattern detection: Only known vulnerable patterns are transformed
Dynamic patterns: Runtime-generated regex cannot be analyzed
Complex cases: Some edge cases may require manual review
Context awareness: Limited understanding of regex usage context

References

License

MIT

Registry

Ready to contribute?

codemod/replace-vulnerable-regex-patterns

Run locally