Regular expressions should not be vulnerable to Denial of Service attacks

[Peapodsec (PeapodSecurity)]

Must-share information (formatted with Markdown):

• SonarQube Enterprise version 10.3

We see the rule for “Regular expressions should not be vulnerable to Denial of Service attacks” is enabled for one of our projects, the issue in particular is in the code and is being reported in GitHub but it doesn’t show up in SonarQube, could you help if there are any configuration changes that needs to be done for the issue to show up in SonarQube as well?

Thank you

[ganncamp (G Ann Campbell)]

Hi,

@Peapodsec

is being reported in GitHub

Would you mind providing a screenshot of this? And also of where it isn’t reported in SonarQube?

 
Thx,
Ann

[Peapodsec (PeapodSecurity)]

Please see screenshots attached. Code scanning in GitHub is reporting the issue and the issue is not being picked up in SonarQube even when we have a similar rule available.

Thank you!!

[ganncamp (G Ann Campbell)]

Hi,

Thanks for the rule description screenshots. Could I see where the issue is raised in GitHub, redacted as necessary?

 
Thx,
Ann

[Peapodsec (PeapodSecurity)]

The issue is raised here

[ganncamp (G Ann Campbell)]

Hi,

Thanks for the screenshot. It seems to show that an issue is raised in Github, not by SonarQube analysis, which is what I thought you were saying, but by CodeQL.

Which language are we talking about? Could you please provide a compact code sample to reproduce this?

 
Thx,
Ann