How to filter evil Regex and filter input with regex in python?

  1. Is there security regex library or database that can use a list of regex to filter and check vulnerable input in python?

  2. Some regex itself are evil too, how to filter evil or vulnerable regex to protect regex match and regex find etc function in python? https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS

closed as too broad by Steffen Ullrich, Xander, CaffeineAddiction, multithr3at3d, ThoriumBR Jun 18 '18 at 21:23


  • 3
    It is partially unclear what you are asking and partly too broad. Your have two independent questions - please restrict yourself to a single one per post. As for the first: it is unclear what kind of "vulnerable input" you imagine so it is not clear what should be filtered. Also, why do you want specifically regex instead of other methods of input validation? – Steffen Ullrich Jun 8 '18 at 14:24
  • Can you write a (partial) Python compiler in regex? if so, you have something that can "understand" what python does. If that's technologically impossible, then regex isn't the tool to analyze code. Related is this, although it only concerns itself with parsing a data representation format, not even a programming language. – Marcus Müller Jun 8 '18 at 14:45
  • And no, regexp in theory are never evil. If the code that processes the regexps has a bug or conceptual security flaw, then the code is the problem. And instead of trying to recognize when this bug is abused, just fixing it would be better (or both). – deviantfan Jun 8 '18 at 14:55
  • Then focus on question 2, owasp.org/index.php/… – Prince Martin Jun 8 '18 at 23:47
  • @PrinceMartin From your link: "[an] attack, that exploits the fact that most Regular Expression implementations ..." . Anyways, regexps from outside of a server are necessary, the magic word is timeout here. – deviantfan Jun 11 '18 at 22:26

To prevent SQL injection you don't need any regex to filter input. In python use prepared statements. No matter what parameter you put to the prepared statement you have a quarantine that there is no SQL injection.
