ReDosDetector extends OpcodeStackDetector { public void analyseRegexString(String regex) { if (regex.length() > 0) { recurAnalyseRegex(regex, regex.length() - 1, 0); } } ReDosDetector(BugReporter bugReporter); @Override void sawOpcode(int seen); void analyseRegexString(String regex);  }
@Test public void analyseSafePattern() { BugReporter reporter = mock(BugReporter.class); ReDosDetector detector = new ReDosDetector(reporter); detector.analyseRegexString(""); detector.analyseRegexString("[a-zA-Z]+[0-9]*"); detector.analyseRegexString("(id-[0-9]+)-([0-9A-F]*)"); verify(reporter, never()).reportBug(bugDefinition().bugType("REDOS").build()); }
@Test public void analyseSuspectPattern() { BugReporter reporter = mock(BugReporter.class); ReDosDetector detector = new ReDosDetector(reporter); detector.analyseRegexString("((a)+)+"); verify(reporter).reportBug(bugDefinition().bugType("REDOS").build()); reset(reporter); detector.analyseRegexString("([b-d])(([a]*))+(0-9)"); verify(reporter).reportBug(bugDefinition().bugType("REDOS").build()); }