CodePark/ questions / Input validation & safe defaults
START PRACTICINGPRACTICE
Backend question · Auth & security › Input validation & safe defaults

What can a single request with the email aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa! do to this Node server?

const EMAIL = /^([a-zA-Z0-9]+)+@example\.com$/;

app.post("/invite", (req, res) => {
  if (!EMAIL.test(req.body.email)) return res.sendStatus(400);
  // ...
});
Block the event loop for a long time through catastrophic backtracking (ReDoS)

This request can block the event loop for a long time. The cause is catastrophic backtracking, an attack called ReDoS (Regular expression Denial of Service).

The nested quantifier ([a-zA-Z0-9]+)+ gives the regex engine an exponential number of ways to split the input. When the match fails at the !, the engine tries all of them. Node runs JavaScript on one thread, so every other request waits.

"Nothing, because the regex is anchored with ^ and $" is wrong. Anchors don't prevent this backtracking.

To defend:
• Avoid nested quantifiers.
• Limit the input length before matching.
• Use well-tested validators.