title: How can I programmatically identify evil regexes?
body: <p>Is there an algorithm to determine whether a given JavaScript regex is vulnerable to <a href="https://en.wikipedia.org/wiki/ReDoS" rel="nofollow">ReDoS</a>? The algorithm doesn't have to be perfect - some false positives and false negatives are acceptable. (I'm specifically interested in <a href="http://www.ecma-international.org/publications/standards/Ecma-262.htm" rel="nofollow">ECMA-262</a> regexes.)</p>