Add end-to-end ERE ReDoS query tests

Author: Copilot

cpp/ql/test/query-tests/Security/CWE/CWE-1333-ReDoS/ReDoS.expected

@@ -32,5 +32,7 @@
 | test.cpp:167:28:167:28 | b | This part of the regular expression may cause exponential backtracking on strings starting with 'W' and containing many repetitions of 'bW'. |
 | test.cpp:176:24:176:25 | ab | This part of the regular expression may cause exponential backtracking on strings starting with 'a' and containing many repetitions of 'ab'. |
 | test.cpp:229:24:229:29 | [a-z]+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'a'. |
-| test.cpp:250:24:250:35 | [[:alpha:]]+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'a'. |
-| test.cpp:252:24:252:35 | [[:alpha:]]+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '0'. |
+| test.cpp:236:24:236:25 | a+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'a'. |
+| test.cpp:257:24:257:35 | [[:alpha:]]+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'a'. |
+| test.cpp:259:24:259:35 | [[:alpha:]]+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '0'. |
+| test.cpp:324:24:324:29 | [a-z]+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'a'. |

cpp/ql/test/query-tests/Security/CWE/CWE-1333-ReDoS/test.cpp

@@ -227,15 +227,22 @@ int main(int argc, char** argv) {
 
     // BAD: exponential regex with icase — case-insensitivity does not suppress the alert.
     { std::regex re("^([a-z]+)+$", std::regex_constants::icase); run(re, input); }
-    // GOOD: non-ECMAScript grammar (basic) is excluded by the Phase 1 parser.
+    // GOOD: BRE grammar (basic) is not yet modelled by the parser and is
+    // excluded by the `RegExp` characteristic predicate.
     { std::regex re("^(a+)+$", std::regex_constants::basic); run(re, input); }
-    // GOOD: non-ECMAScript grammar (extended) is excluded.
+    // BAD: extended selects the ERE grammar (modelled by `EreRegExp` since
+    // Phase C) and is backtracking-eligible, so the shared engine reports
+    // the nested-quantifier as exponential — same as the ECMAScript case.
     { std::regex re("^(a+)+$", std::regex_constants::extended); run(re, input); }
-    // GOOD: non-ECMAScript grammar (awk) is excluded.
+    // GOOD: awk parses as ERE (same as `extended`) but is excluded from the
+    // ReDoS queries by `isBacktrackingEngine` (POSIX tool-style engines are
+    // treated as linear-time), *not* by any parsing/grammar difference.
     { std::regex re("^(a+)+$", std::regex_constants::awk); run(re, input); }
-    // GOOD: non-ECMAScript grammar (grep) is excluded.
+    // GOOD: grep selects BRE and, like `basic`, is not yet parsed.
     { std::regex re("^(a+)+$", std::regex_constants::grep); run(re, input); }
-    // GOOD: non-ECMAScript grammar (egrep) is excluded.
+    // GOOD: egrep parses as ERE (same as `extended`) but is excluded from
+    // the ReDoS queries by `isBacktrackingEngine`, *not* by any
+    // parsing/grammar difference.
     { std::regex re("^(a+)+$", std::regex_constants::egrep); run(re, input); }
 
     // -------------------------------------------------------------------------
@@ -266,15 +273,17 @@ int main(int argc, char** argv) {
     // 10. Non-backtracking POSIX tool-style grammars (`awk`, `grep`, `egrep`)
     //     combined with other flags via bitwise-OR.
     //
-    // Regression guard: these must remain excluded from cpp/redos once a
-    // future phase relaxes the parser to accept non-ECMAScript grammars, via
-    // the `isBacktrackingEngine` gate. The equivalent default-grammar
-    // patterns (section 2 above) fire, showing that the gate — not some
-    // unrelated exclusion — suppresses these cases.
+    // Regression guard for the `isBacktrackingEngine` gate: `awk` and
+    // `egrep` are parsed as ERE (`EreRegExp`, Phase C) — structurally the
+    // same tree the `extended` positive cases above are analyzed with — so
+    // suppression here is exclusively due to `isBacktrackingEngine`, not
+    // any parsing/grammar difference. `grep` still selects BRE and is
+    // additionally unparsed until BRE support lands, but the query-level
+    // gate would suppress it regardless.
     //
-    // Today the parser also drops all non-ECMAScript grammar literals, so
-    // these cases would be suppressed regardless; the query-level gate is a
-    // regression guard for the parser-relaxation phase.
+    // The equivalent default-grammar (ECMAScript) patterns in section 2
+    // above fire, showing that the gate — not some unrelated exclusion —
+    // suppresses these cases.
     // -------------------------------------------------------------------------
 
     // GOOD: awk grammar — non-backtracking.
@@ -290,5 +299,42 @@ int main(int argc, char** argv) {
                     (std::regex_constants::egrep | std::regex_constants::icase));
       run(re, input); }
 
+    // -------------------------------------------------------------------------
+    // 11. End-to-end ERE-grammar coverage for cpp/redos.
+    //
+    // These cases exercise the ERE parser (Phase C, `EreRegExp`) end-to-end
+    // through the shared backtracking engine. All three flags below
+    // (`extended`, `egrep`, `awk`) select the *same* grammar (ERE) and
+    // therefore produce structurally-identical parse trees for the same
+    // pattern string — the only axis they differ on is
+    // `isBacktrackingEngine`:
+    //
+    //   * `extended` → ERE + backtracking-eligible → flagged.
+    //   * `egrep` / `awk` → ERE + non-backtracking → NOT flagged.
+    //
+    // The pattern `^([a-z]+)+$` is chosen because it (a) uses only ERE-legal
+    // constructs (no `\d`/`\w`/backrefs/lookaround, which are literals in
+    // ERE) so the ERE parse tree is genuinely equivalent to the ECMAScript
+    // one, and (b) is a known-exponential nested-quantifier shape (same as
+    // the ECMAScript case at line 99 above) so we can be confident the
+    // shared engine reports it.
+    // -------------------------------------------------------------------------
+
+    // BAD: ERE grammar via `extended` — parsed as ERE and backtracking-eligible.
+    { std::regex re("^([a-z]+)+$", std::regex_constants::extended); run(re, input); }
+    // GOOD: same pattern under `egrep` — parses identically as ERE but
+    // excluded by `isBacktrackingEngine`.
+    { std::regex re("^([a-z]+)+$", std::regex_constants::egrep); run(re, input); }
+    // GOOD: same pattern under `awk` — parses identically as ERE but
+    // excluded by `isBacktrackingEngine`.
+    { std::regex re("^([a-z]+)+$", std::regex_constants::awk); run(re, input); }
+    // GOOD: `egrep | icase` bitwise-OR combination — still ERE-parsed and
+    // still excluded by `isBacktrackingEngine`; case-folding does not
+    // re-enable the backtracking-engine gate.
+    { std::regex re("^([a-z]+)+$",
+                    (std::regex_constants::syntax_option_type)
+                    (std::regex_constants::egrep | std::regex_constants::icase));
+      run(re, input); }
+
     return 0;
 }

cpp/ql/test/query-tests/Security/CWE/CWE-1333/PolynomialReDoS.expected

@@ -7,12 +7,14 @@ edges
 | test.cpp:107:27:107:30 | **argv | test.cpp:192:28:192:32 | *input | provenance | TaintFunction |
 | test.cpp:107:27:107:30 | **argv | test.cpp:279:27:279:31 | *input | provenance | TaintFunction |
 | test.cpp:107:27:107:30 | **argv | test.cpp:308:28:308:32 | *input | provenance | TaintFunction |
-| test.cpp:107:27:107:30 | **argv | test.cpp:342:27:342:31 | *input | provenance | TaintFunction |
-| test.cpp:107:27:107:30 | **argv | test.cpp:349:27:349:31 | *input | provenance | TaintFunction |
-| test.cpp:107:27:107:30 | **argv | test.cpp:421:26:421:30 | *input | provenance | TaintFunction |
-| test.cpp:369:27:369:57 | *call to getenv | test.cpp:369:27:369:57 | *call to getenv | provenance |  |
-| test.cpp:369:27:369:57 | *call to getenv | test.cpp:372:28:372:28 | *s | provenance | TaintFunction |
-| test.cpp:380:20:380:22 | fread output argument | test.cpp:383:28:383:28 | *s | provenance | TaintFunction |
+| test.cpp:107:27:107:30 | **argv | test.cpp:323:28:323:32 | *input | provenance | TaintFunction |
+| test.cpp:107:27:107:30 | **argv | test.cpp:353:27:353:31 | *input | provenance | TaintFunction |
+| test.cpp:107:27:107:30 | **argv | test.cpp:360:27:360:31 | *input | provenance | TaintFunction |
+| test.cpp:107:27:107:30 | **argv | test.cpp:432:26:432:30 | *input | provenance | TaintFunction |
+| test.cpp:107:27:107:30 | **argv | test.cpp:496:28:496:32 | *input | provenance | TaintFunction |
+| test.cpp:380:27:380:57 | *call to getenv | test.cpp:380:27:380:57 | *call to getenv | provenance |  |
+| test.cpp:380:27:380:57 | *call to getenv | test.cpp:383:28:383:28 | *s | provenance | TaintFunction |
+| test.cpp:391:20:391:22 | fread output argument | test.cpp:394:28:394:28 | *s | provenance | TaintFunction |
 nodes
 | test.cpp:107:27:107:30 | **argv | semmle.label | **argv |
 | test.cpp:117:28:117:32 | *input | semmle.label | *input |
@@ -23,14 +25,16 @@ nodes
 | test.cpp:192:28:192:32 | *input | semmle.label | *input |
 | test.cpp:279:27:279:31 | *input | semmle.label | *input |
 | test.cpp:308:28:308:32 | *input | semmle.label | *input |
-| test.cpp:342:27:342:31 | *input | semmle.label | *input |
-| test.cpp:349:27:349:31 | *input | semmle.label | *input |
-| test.cpp:369:27:369:57 | *call to getenv | semmle.label | *call to getenv |
-| test.cpp:369:27:369:57 | *call to getenv | semmle.label | *call to getenv |
-| test.cpp:372:28:372:28 | *s | semmle.label | *s |
-| test.cpp:380:20:380:22 | fread output argument | semmle.label | fread output argument |
+| test.cpp:323:28:323:32 | *input | semmle.label | *input |
+| test.cpp:353:27:353:31 | *input | semmle.label | *input |
+| test.cpp:360:27:360:31 | *input | semmle.label | *input |
+| test.cpp:380:27:380:57 | *call to getenv | semmle.label | *call to getenv |
+| test.cpp:380:27:380:57 | *call to getenv | semmle.label | *call to getenv |
 | test.cpp:383:28:383:28 | *s | semmle.label | *s |
-| test.cpp:421:26:421:30 | *input | semmle.label | *input |
+| test.cpp:391:20:391:22 | fread output argument | semmle.label | fread output argument |
+| test.cpp:394:28:394:28 | *s | semmle.label | *s |
+| test.cpp:432:26:432:30 | *input | semmle.label | *input |
+| test.cpp:496:28:496:32 | *input | semmle.label | *input |
 subpaths
 #select
 | test.cpp:117:28:117:32 | *input | test.cpp:107:27:107:30 | **argv | test.cpp:117:28:117:32 | *input | This $@ that depends on a $@ may run slow on strings with many repetitions of ' '. | test.cpp:116:29:116:31 | \\s+ | regular expression | test.cpp:107:27:107:30 | **argv | user-provided value |
@@ -42,8 +46,10 @@ subpaths
 | test.cpp:192:28:192:32 | *input | test.cpp:107:27:107:30 | **argv | test.cpp:192:28:192:32 | *input | This $@ that depends on a $@ may run slow on strings with many repetitions of ' '. | test.cpp:191:29:191:31 | \\s+ | regular expression | test.cpp:107:27:107:30 | **argv | user-provided value |
 | test.cpp:279:27:279:31 | *input | test.cpp:107:27:107:30 | **argv | test.cpp:279:27:279:31 | *input | This $@ that depends on a $@ may run slow on strings with many repetitions of ' '. | test.cpp:278:29:278:31 | \\s+ | regular expression | test.cpp:107:27:107:30 | **argv | user-provided value |
 | test.cpp:308:28:308:32 | *input | test.cpp:107:27:107:30 | **argv | test.cpp:308:28:308:32 | *input | This $@ that depends on a $@ may run slow on strings with many repetitions of ' '. | test.cpp:307:29:307:31 | \\s+ | regular expression | test.cpp:107:27:107:30 | **argv | user-provided value |
-| test.cpp:342:27:342:31 | *input | test.cpp:107:27:107:30 | **argv | test.cpp:342:27:342:31 | *input | This $@ that depends on a $@ may run slow on strings with many repetitions of '9'. | test.cpp:341:25:341:27 | \\d+ | regular expression | test.cpp:107:27:107:30 | **argv | user-provided value |
-| test.cpp:349:27:349:31 | *input | test.cpp:107:27:107:30 | **argv | test.cpp:349:27:349:31 | *input | This $@ that depends on a $@ may run slow on strings with many repetitions of 'a'. | test.cpp:348:26:348:27 | .* | regular expression | test.cpp:107:27:107:30 | **argv | user-provided value |
-| test.cpp:372:28:372:28 | *s | test.cpp:369:27:369:57 | *call to getenv | test.cpp:372:28:372:28 | *s | This $@ that depends on a $@ may run slow on strings with many repetitions of ' '. | test.cpp:371:29:371:31 | \\s+ | regular expression | test.cpp:369:27:369:57 | *call to getenv | user-provided value |
-| test.cpp:383:28:383:28 | *s | test.cpp:380:20:380:22 | fread output argument | test.cpp:383:28:383:28 | *s | This $@ that depends on a $@ may run slow on strings with many repetitions of ' '. | test.cpp:382:29:382:31 | \\s+ | regular expression | test.cpp:380:20:380:22 | fread output argument | user-provided value |
-| test.cpp:421:26:421:30 | *input | test.cpp:107:27:107:30 | **argv | test.cpp:421:26:421:30 | *input | This $@ that depends on a $@ may run slow on strings with many repetitions of 'a'. | test.cpp:420:25:420:26 | a+ | regular expression | test.cpp:107:27:107:30 | **argv | user-provided value |
+| test.cpp:323:28:323:32 | *input | test.cpp:107:27:107:30 | **argv | test.cpp:323:28:323:32 | *input | This $@ that depends on a $@ may run slow on strings with many repetitions of ' '. | test.cpp:322:29:322:31 | \\s+ | regular expression | test.cpp:107:27:107:30 | **argv | user-provided value |
+| test.cpp:353:27:353:31 | *input | test.cpp:107:27:107:30 | **argv | test.cpp:353:27:353:31 | *input | This $@ that depends on a $@ may run slow on strings with many repetitions of '9'. | test.cpp:352:25:352:27 | \\d+ | regular expression | test.cpp:107:27:107:30 | **argv | user-provided value |
+| test.cpp:360:27:360:31 | *input | test.cpp:107:27:107:30 | **argv | test.cpp:360:27:360:31 | *input | This $@ that depends on a $@ may run slow on strings with many repetitions of 'a'. | test.cpp:359:26:359:27 | .* | regular expression | test.cpp:107:27:107:30 | **argv | user-provided value |
+| test.cpp:383:28:383:28 | *s | test.cpp:380:27:380:57 | *call to getenv | test.cpp:383:28:383:28 | *s | This $@ that depends on a $@ may run slow on strings with many repetitions of ' '. | test.cpp:382:29:382:31 | \\s+ | regular expression | test.cpp:380:27:380:57 | *call to getenv | user-provided value |
+| test.cpp:394:28:394:28 | *s | test.cpp:391:20:391:22 | fread output argument | test.cpp:394:28:394:28 | *s | This $@ that depends on a $@ may run slow on strings with many repetitions of ' '. | test.cpp:393:29:393:31 | \\s+ | regular expression | test.cpp:391:20:391:22 | fread output argument | user-provided value |
+| test.cpp:432:26:432:30 | *input | test.cpp:107:27:107:30 | **argv | test.cpp:432:26:432:30 | *input | This $@ that depends on a $@ may run slow on strings with many repetitions of 'a'. | test.cpp:431:25:431:26 | a+ | regular expression | test.cpp:107:27:107:30 | **argv | user-provided value |
+| test.cpp:496:28:496:32 | *input | test.cpp:107:27:107:30 | **argv | test.cpp:496:28:496:32 | *input | This $@ that depends on a $@ may run slow on strings with many repetitions of ' '. | test.cpp:495:29:495:31 | \\s+ | regular expression | test.cpp:107:27:107:30 | **argv | user-provided value |