466
While there is some overlap with allowlist/denylist problems, this entry is intended to deal with
incorrectly written regular expressions, regardless of their intended use. Not every regular
expression is intended for use as an allowlist or denylist. In addition, allowlists and denylists can
be implemented using other mechanisms besides regular expressions.
Research Gap
Regexp errors are likely a primary factor in many MFVs, especially those that require multiple
manipulations to exploit. However, they are rarely diagnosed at this level of detail.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Regular Expression Error
Related Attack Patterns
CAPEC-ID Attack Pattern Name
6 Argument Injection
15 Command Delimiters
79 Using Slashes in Alternate Encoding
References
[REF-7]Michael Howard and David LeBlanc. "Writing Secure Code". 2nd Edition. 2002
December 4. Microsoft Press. < https://www.microsoftpressstore.com/store/writing-securecode-
9780735617223 >.
CWE-186: Overly Restrictive Regular Expression
Weakness ID : 186
Structure : Simple
Abstraction : Base
Description
A regular expression is overly restrictive, which prevents dangerous values from being detected.
Extended Description
This weakness is not about regular expression complexity. Rather, it is about a regular expression
that does not match all values that are intended. Consider the use of a regexp to identify
acceptable values or to spot unwanted terms. An overly restrictive regexp misses some potentially
security-relevant values leading to either false positives *or* false negatives, depending on how
the regexp is being used within the code. Consider the expression /[0-8]/ where the intention
was /[0-9]/. This expression is not "complex" but the value "9" is not matched when maybe the
programmer planned to check for it.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 185 Incorrect Regular Expression 463
CanAlsoBe 183 Permissive List of Allowed Inputs 458
CanAlsoBe 184 Incomplete List of Disallowed Inputs 459
Relevant to the view "Software Development" (CWE-699)
CWE Version 4.14
CWE-187: Partial String Comparison
CWE-187: Partial String Comparison