redosray
aurelio-nakamura.github.io- Category
- Cybersecurity
- Rank
- No. 1221Tools index
- Pricing
- Open Source
- Platform
- web · cli
- Type
- TOOL
- Date
About
A ReDoS (Regular Expression Denial of Service) detection tool that goes beyond static pattern matching by actually running each flagged regex against a purpose-built attack string in an isolated worker, timing the match to produce a proven hang rather than a guess. It ships as both a browser playground and a CLI that scans JavaScript, TypeScript, and Python source for vulnerable regex literals, reporting file:line and the exact killer input, with a CI mode that exits non-zero on confirmed findings.
What it can do
Statically flag suspicious regex patterns in source code
JavaScript, TypeScript, or Python source code → List of flagged regex patterns
Run a flagged regex against a purpose-built attack string in an isolated worker to confirm a ReDoS hang
Regex pattern → Timed hang confirmation
Scan source files for vulnerable regex literals and report their location
JavaScript, TypeScript, or Python source files → File:line location of vulnerable regex
Produce the exact input string that triggers the regex hang
Regex pattern → Killer input string
Why it made the leaderboard
It eliminates the false-positive noise that makes most ReDoS linters get ignored by only reporting regexes it has actually timed out, and ships a CI-gate exit code for catching them before they hit production.
Tags
Media
Comments (0)
No comments yet
Editorially curated, with community endorsements as a secondary signal. Corrections welcome.