Rule Definition
The software constructs all or part of a Regular expression via user-controllable inputs. These inputs are not neutralized or are incorrectly neutralized. As a consequence, a user may create a Denial Of Service attack.

Remediation
Use authorized sanitization methods, limit the computation time of the Regular expression.

Violation Code Sample

string login = textBoxLogin.Text;
string password = textBoxPassword.Text;
var regex = new Regex(login);
if (regex.Match(password).Success)
    MessageBox.Show("ERROR: the name must not be present in the password");
else
    MessageBox.Show("Correct password");

Fixed Code Sample

string login = textBoxLogin.Text;
string password = textBoxPassword.Text;
var regex = new Regex(Regex.Escape(login));
if (regex.Match(password).Success)
    MessageBox.Show("ERROR: the name must not be present in the password");
else
    MessageBox.Show("Correct password");

Regular expression Denial of Service - ReDoS https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS CWE-400: Uncontrolled Resource Consumption https://cwe.mitre.org/data/definitions/400.html Weaknesses in the 2019 CWE Top 25 Most Dangerous Software Errors https://cwe.mitre.org/data/definitions/1200.html