Will It Vibe?Regex with a catastrophic-backtracking shape (ReDoS)
Part of Code Quality & Syntax, which counts for 20% of the overall score. When this check fires it deducts 8 points from that category, once per scan, no matter how many places it turns up.
What it detects
A pattern passed to re.compile/match/search/fullmatch/sub/split/findall/finditer has a nested-quantifier shape such as (a+)+, (.*)+, or (\w+)*. Against a crafted input Python's backtracking engine can take exponential time (CWE-1333). Shape heuristic: some matches are safe because the inner and outer parts cannot both consume the same characters, so confirm before treating this as urgent.
Why it matters
A regex passed to re.compile/match/search/fullmatch/sub/split/findall/finditer with a nested-quantifier shape like (a+)+, (.*)+, or (\w+)* can make Python's backtracking regex engine take exponential time on certain crafted inputs (ReDoS, CWE-1333). Run against user-supplied or otherwise untrusted text, a single request can pin a CPU core for seconds or longer. This is a shape-based heuristic: it flags the pattern's structure, not proof a bad input exists, and some matches are actually safe because the inner and outer parts cannot both match the same characters.
How to fix it
Rewrite the pattern to remove the nested repetition, most often by making the inner and outer parts mutually exclusive, or split the match into two simpler patterns applied in sequence. Python 3.11+ can also switch to the re module's stricter matching in some cases, but simplifying the pattern itself is the reliable fix; verify with a regex-complexity tool if you are unsure.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo