regexSuperLinearBacktracking

Reports regular expressions with exponential or polynomial backtracking.

✅ This rule is included in the ts logical and logicalStrict presets.

Reports regular expressions that can cause exponential or polynomial backtracking. These patterns can be exploited to cause Regular Expression Denial of Service (ReDoS) attacks, where a malicious input string causes the regex engine to take an extremely long time to process.

Examples

Self-Referential Quantifiers

When a quantifier can reach itself through a parent quantifier, it can cause exponential backtracking.

❌ Incorre

AEconsB0patteAE< =sp ansty="le--0:#5CA7E4;--1:#3A68">81<1/sp ansty="le--0:#5CA7E4;--1:#3A68">8F(?<:asp ansty="le--0:#7FDBCA;--1:#096E">7<2+sp ansty="le--0:#5CA7E4;--1:#3A68">87<2+sp ansty="le--0:#D9F5DD;--1:#1111">1<1/sp ansty="le--0:#D6DEEB;--1:#403F">5<3;d ivclassNa="meco">AEconsB0patteAE< =sp ansty="le--0:#5CA7E4;--1:#3A68">81<1/sp ansty="le--0:#5CA7E4;--1:#3A68">8Fb(?<:asp ansty="le--0:#7FDBCA;--1:#096E">7<2+sp ansty="le--0:#5CA7E4;--1:#3A68">87<2+sp ansty="le--0:#5CA7E4;--1:#3A68">81<1/sp ansty="le--0:#D6DEEB;--1:#403F">5<3;d ivclassNa="meco">

44AEco61B0pat446<88F spans="tyle--0:#D9F5DD;--1:#11">1<111/ spans="tyle--0:#5CA7E4;--1:#3A">688F(61<111/ spans="tyle--0:#D6DEEB;--1:#40">3<)+/><;di vdivclass="Nameexpressive-">44AEco61B0pat446<88F spans="tyle--0:#D9F5DD;--1:#11">1<111/ spans="tyle--0:#5CA7E4;--1:#3A">68<8Fba spans="tyle--0:#7FDBCA;--1:#09">66<88Fb spans="tyle--0:#D9F5DD;--1:#11">1<111/ spans="tyle--0:#D6DEEB;--1:#40">3<+b/>

Trading Quantifiers

When two quantifiers can exchange characters, it causes polynomial backtracking.

❌ Incorre

AEconsB0patteAE< =sp ansty="le--0:#5CA7E4;--1:#3A68">81<1/sp ansty="le--0:#C792EA;--1:#8844">AE<\bsp ansty="le--0:#5CA7E4;--1:#3A68">87<2+sp ansty="le--0:#5CA7E4;--1:#3A68">87<2+sp ansty="le--0:#C792EA;--1:#8844">A1<1/sp ansty="le--0:#D6DEEB;--1:#403F">5<3;d ivclassNa="meco">AEconsB0patteAE< =sp ansty="le--0:#5CA7E4;--1:#3A68">81<1/sp ansty="le--0:#C792EA;--1:#8844">AE<\bsp ansty="le--0:#82AAFF;--1:#3B61">B0<\wsp ansty="le--0:#7FDBCA;--1:#096E">7<2+sp ansty="le--0:#5CA7E4;--1:#3A68">8B0<\wsp ansty="le--0:#7FDBCA;--1:#096E">7<2+sp ansty="le--0:#C792EA;--1:#8844">A1<1/sp ansty="le--0:#D6DEEB;--1:#403F">5<3;d ivclassNa="meco">

44AEco61B0pat446<88F spans="tyle--0:#D9F5DD;--1:#11">1<111/ spans="tyle--0:#C792EA;--1:#88">446<88Fa spans="tyle--0:#7FDBCA;--1:#09">64<4AE$ spans="tyle--0:#D9F5DD;--1:#11">1<111/ spans="tyle--0:#D6DEEB;--1:#40">3<+$/><;di vdivclass="Nameexpressive-">44AEco61B0pat446<88F spans="tyle--0:#D9F5DD;--1:#11">1<111/ spans="tyle--0:#C792EA;--1:#88">446166<88Fa spans="tyle--0:#C792EA;--1:#88">4<4AE$ spans="tyle--0:#D9F5DD;--1:#11">1<111/ spans="tyle--0:#D6DEEB;--1:#40">3

RegExp Constructor

The rule also applies to patterns created with the RegExp constructor.

❌ Incorre

AEconsB0patteAE <= sp ansty="le--0:#7FDBCA;--1:#096E">72nAB0RegE5<3(sp ansty="le--0:#D9F5DD;--1:#1111">1<1"sp ansty="le--0:#ECC48D;--1:#984E">4D(?:a+<)+sp ansty="le--0:#D9F5DD;--1:#1111">1<1"sp ansty="le--0:#D6DEEB;--1:#403F">53<);d ivclassNa="meco"><);d>

44AEco61B0pat44A6E7<2new spans="tyle--0:#C792EA;--1:#88">4<4AE spans="tyle--0:#82AAFF;--1:#3B">61B0Re31<111" spans="tyle--0:#ECC48D;--1:#98">4E4D(?<:a)+ spans="tyle--0:#D9F5DD;--1:#11">1<111" spans="tyle--0:#D6DEEB;--1:#40">3F<53) ;divclass="Name"><+")>

Options

This rule is not configurable.

When Not To Use It

If you are confident that your regular expressions will only be used with trusted input that cannot be manipulated by attackers, you might consider disabling this rule.

Further Reading

• MDN: Regular expressions
• OWASP: Regular expression Denial of Service - ReDoS

Equivalents in Other Linters

• ESLint: regexp/no-super-linear-backtracking