CWE-1333: Inefficient Regular Expression Complexity

Description:
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-407, CWE-407

Consequences:
  - Availability: DoS: Resource Consumption (CPU)

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Architecture and Design] Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
  - [System Configuration] Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.
  - [Implementation] Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.
  - [Implementation] Limit the length of the input that the regular expression will process.

Demonstrative examples:
This example attempts to check if an input string is a "sentence" [REF-1164].
The regular expression has a vulnerable backtracking clause inside (\w+\s?)*$ which can be triggered to cause a Denial of Service by processing particular phrases. 
		     To fix the backtracking problem, backtracking is removed with the ?= portion of the expression which changes it to a lookahead and the \2 which prevents the backtracking. The modified example is:
var test_string = "Bad characters: $@#"; 
                        var bad_pattern  = /^(\w+\s?)*$/i; 
                        var result = test_string.search(bad_pattern);
var test_string = "Bad characters: $@#"; 
                        var good_pattern  = /^((?=(\w+))\2\s?)*$/i; 
                        var result = test_string.search(good_pattern);

This example attempts to check if an input string is a "sentence" and is modified for Perl [REF-1164].
The regular expression has a vulnerable backtracking clause inside (\w+\s?)*$ which can be triggered to cause a Denial of Service by processing particular phrases. 
		     To fix the backtracking problem, backtracking is removed with the ?= portion of the expression which changes it to a lookahead and the \2 which prevents the backtracking. The modified example is:
my $test_string = "Bad characters: \$\@\#"; 
                        my $bdrslt = $test_string; 
                        $bdrslt =~ /^(\w+\s?)*$/i;
my $test_string = "Bad characters: \$\@\#"; 
                        my $gdrslt = $test_string; 
                         $gdrslt =~ /^((?=(\w+))\2\s?)*$/i;

Real-world examples:
  - CVE-2020-5243: server allows ReDOS with crafted User-Agent strings, due to overlapping capture groups that cause excessive backtracking.
  - CVE-2021-21317: npm package for user-agent parser prone to ReDoS due to overlapping capture groups
  - CVE-2019-16215: Markdown parser uses inefficient regex when processing a message, allowing users to cause CPU consumption and delay preventing processing of other messages.
  - CVE-2019-6785: Long string in a version control product allows DoS due to an inefficient regex.
  - CVE-2019-12041: Javascript code allows ReDoS via a long string due to excessive backtracking.