CWE-625: Permissive Regular Expression

Description

The product uses a regular expression that does not sufficiently restrict the set of allowed values.

This effectively causes the regexp to accept substrings that match the pattern, which produces a partial comparison to the target. In some cases, this can lead to other weaknesses. Common errors include:

Potential Impact

Demonstrative Examples

$phone = GetPhoneNumber();if ($phone =~ /\d+-\d+/) {
                           # looks like it only has hyphens and digits
                           system("lookup-phone $phone");}
                     else {error("malformed number!");}

import subprocess
		  import re
		  
		  def validate_ip_regex(ip: str):
		  
		    ip_validator = re.compile(r"((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)\.?\b){4}")
		    if ip_validator.match(ip):
		    
		      return ip
		    
		    else:
		    
		      raise ValueError("IP address does not match valid pattern.")
		    
		  
		  
		  def run_ping_regex(ip: str):
		  
		    validated = validate_ip_regex(ip)
		    # The ping command treats zero-prepended IP addresses as octal
		    result = subprocess.call(["ping", validated])
		    print(result)

Mitigations & Prevention

Detection Methods

• Automated Static Analysis High — Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then sea

Real-World CVE Examples

Related Weaknesses

Taxonomy Mappings

• The CERT Oracle Secure Coding Standard for Java (2011): IDS08-J — Sanitize untrusted data passed to a regex