@@ -78,26 +78,40 @@ predicate isExponentialRegex(StringLiteral s) {
7878}
7979
8080/**
81+ * DEPRECATED: Use `ExponentialRegexDataflow` instead.
82+ *
8183 * A data flow configuration for tracking exponential worst case time regular expression string
8284 * literals to the pattern argument of a regex.
8385 */
84- class ExponentialRegexDataflow extends DataFlow2:: Configuration {
86+ deprecated class ExponentialRegexDataflow extends DataFlow2:: Configuration {
8587 ExponentialRegexDataflow ( ) { this = "ExponentialRegex" }
8688
8789 override predicate isSource ( DataFlow:: Node s ) { isExponentialRegex ( s .asExpr ( ) ) }
8890
8991 override predicate isSink ( DataFlow:: Node s ) { s .asExpr ( ) = any ( RegexOperation c ) .getPattern ( ) }
9092}
9193
94+ /**
95+ * A data flow configuration for tracking exponential worst case time regular expression string
96+ * literals to the pattern argument of a regex.
97+ */
98+ private module ExponentialRegexDataFlowConfig implements DataFlow:: ConfigSig {
99+ predicate isSource ( DataFlow:: Node s ) { isExponentialRegex ( s .asExpr ( ) ) }
100+
101+ predicate isSink ( DataFlow:: Node s ) { s .asExpr ( ) = any ( RegexOperation c ) .getPattern ( ) }
102+ }
103+
104+ module ExponentialRegexDataFlow = DataFlow:: Global< ExponentialRegexDataFlowConfig > ;
105+
92106/**
93107 * An expression passed as the `input` to a call to a `Regex` method, where the regex appears to
94108 * have exponential behavior.
95109 */
96110class ExponentialRegexSink extends DataFlow:: ExprNode , Sink {
97111 ExponentialRegexSink ( ) {
98- exists ( ExponentialRegexDataflow regexDataflow , RegexOperation regexOperation |
112+ exists ( RegexOperation regexOperation |
99113 // Exponential regex flows to the pattern argument
100- regexDataflow . hasFlow ( _, DataFlow:: exprNode ( regexOperation .getPattern ( ) ) )
114+ ExponentialRegexDataFlow :: flow ( _, DataFlow:: exprNode ( regexOperation .getPattern ( ) ) )
101115 |
102116 // This is used as an input for this pattern
103117 this .getExpr ( ) = regexOperation .getInput ( ) and
0 commit comments