Process wide setting for RegEx match timeout is ignored

StreamingGuy · January 16, 2024, 3:45am

Hello,

We are using regular expressions to validate input in our .Net Core 6 based API. We configured process wide setting for RegEx match timeout using below line of code in Main method, but the Sonar cloud 10.2 is still marking the code “new Regex” with error message “Pass a timeout to limit the execution time.”.

AppDomain.CurrentDomain.SetData("REGEX_DEFAULT_MATCH_TIMEOUT", TimeSpan.FromMilliseconds(100));

Please let me know if we are missing any other settings to consider the above process wide setting.

Thanks for your time

Colin · January 17, 2024, 8:07am

Hey there.

Are you using SonarCloud (https://sonarcloud.io), or SonarQube v10.2?

StreamingGuy · January 17, 2024, 1:17pm

Thank you for the reply. Sorry, we are on SonarQube 10.2 (build 77647).

Please let me know if you need any other information.

StreamingGuy · January 19, 2024, 4:27pm

Hello,

Just checking to see whether this is a false positive as scanner may be ignoring the process wide setting.

Thanks

sebastien.marichal · January 25, 2024, 4:34pm

Hello @StreamingGuy

Welcome to the community!

Thank you for reporting this issue.

I confirm this as a false positive, we do not take into account REGEX_DEFAULT_MATCH_TIMEOUT.
I have created an issue in our backlog to tackle it in the future.

github.com/SonarSource/sonar-dotnet

Fix S6444 FP: REGEX_DEFAULT_MATCH_TIMEOUT in AppDomain should not be ignored

opened 04:30PM - 25 Jan 24 UTC

sebastien-marichal

Type: False Positive Area: C#

From this [community post](https://community.sonarsource.com/t/process-wide-sett…ing-for-regex-match-timeout-is-ignored/107372). Setting the default match timeout through the AppDomain using `REGEX_DEFAULT_MATCH_TIMEOUT` is ignored. See [Regex.MatchTimeout](https://learn.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.matchtimeout?view=net-8.0#remarks) for more information: > ... you can set its value for all Regex matching operations in an application domain by calling the AppDomain.SetData method and providing a TimeSpan value for the "REGEX_DEFAULT_MATCH_TIMEOUT" property... ```c# AppDomain.CurrentDomain.SetData("REGEX_DEFAULT_MATCH_TIMEOUT", TimeSpan.FromMilliseconds(100)); void RegexPattern(string input) { _ = new Regex(".+@.+", RegexOptions.None); // Noncompliant, FP REGEX_DEFAULT_MATCH_TIMEOUT is set in the AppDomain _ = Regex.IsMatch(input, "[0-9]+"); // Noncompliant, FP REGEX_DEFAULT_MATCH_TIMEOUT is set in the AppDomain } ```

Have a nice day!

StreamingGuy · January 25, 2024, 6:23pm

Thank you Sebastien for looking into our request and confirming that as false positive.

Appreciate your time.

sebastien.marichal · January 29, 2024, 9:28am

Hello @StreamingGuy,

It has been pointed out to me that we do not plan to support the REGEX_DEFAULT_MATCH_TIMEOUT.
It is difficult to detect reliably the usage of this property.
If you set this property, you can disable the rule.

For more information, you can check the rule implementation PR.

I hope that works for you.

StreamingGuy · February 3, 2024, 8:32pm

Thank you for the update. We will disable the rule and proceed with further scans.

Thanks again for quickly looking into our request.

system · February 10, 2024, 8:32pm

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.