redosray
aurelio-nakamura.github.io- Category
- Cybersecurity
- Rank
- No. 2049Tools index
Previous survey · No. 1940 ·
- Pricing
- Open Source
- Type
- TOOL
- Use case
- Security & Identity
- Interfaces
- CLI · Web
- Date
About
A ReDoS (Regular Expression Denial of Service) detection tool that goes beyond static pattern matching by actually running each flagged regex against a purpose-built attack string in an isolated worker, timing the match to produce a proven hang rather than a guess. It ships as both a browser playground and a CLI that scans JavaScript, TypeScript, and Python source for vulnerable regex literals, reporting file:line and the exact killer input, with a CI mode that exits non-zero on confirmed findings.
What it does
A browser tool and command line utility for checking regular expressions for catastrophic backtracking risk. Suspect patterns are executed against inputs that grow in length while match duration is timed, showing whether processing time explodes as the input gets longer.
Stated on the product site
- Interfaces
- Offered as both a browser playground and a CLI runnable without installation via npx.
- Languages scanned
- The CLI extracts and checks regex literals found in JavaScript, TypeScript, and Python source files.
- CI integration
- A --ci flag makes the CLI exit non-zero when a confirmed vulnerability is found, positioned for use as a pre-commit or CI gate.
- Offline operation
- Described as pure JavaScript with no dependencies and no network calls, so scanned source is said to stay on the machine running it.
- Output detail
- Findings are reported with a file, line, and column location plus the specific input string that produced the hang.
Not stated on the site
- The page does not state pricing or licensing terms for the CLI or the browser playground.
- The page does not specify which Node.js versions or operating systems the CLI supports.
Written from the product site at aurelio-nakamura.github.io.
What it can do
Statically flag suspicious regex patterns in source code
JavaScript, TypeScript, or Python source code → List of flagged regex patterns
Run a flagged regex against a purpose-built attack string in an isolated worker to confirm a ReDoS hang
Regex pattern → Timed hang confirmation
Scan source files for vulnerable regex literals and report their location
JavaScript, TypeScript, or Python source files → File:line location of vulnerable regex
Produce the exact input string that triggers the regex hang
Regex pattern → Killer input string
Tags
Media
Comments (0)
No comments yet
Editorially curated, with community endorsements as a secondary signal. Corrections welcome.