A denial-of-service (DoS) attack makes a web application unavailable to legitimate users. An attacker may not need to breach a security perimeter: sending so many requests that server resources are exhausted can prevent other visitors from being served. section 1.2
A distributed denial-of-service (DDoS) attack sends requests simultaneously from thousands of servers and Internet Protocol addresses. Because malicious traffic comes from many sources, blocking it by source address is difficult. The 2016 attack on DNS provider Dyn made major websites, including Amazon.com and Zillow.com, unavailable in the United States for much of a day. section 1.2
DoS can also arise through expensive computation rather than ordinary request volume. In regular expression denial-of-service (ReDoS), an attacker controls a regex pattern and the tested string. Deliberately ambiguous “evil regexes” cause extensive backtracking; repeated requests can exhaust server processing power and take the application offline. section 12.15
Reduce regex-based denial-of-service risk by limiting where patterns come from and choosing tools suited to search:
- Define regexes statically in server-side code when users do not need to supply the pattern. section 12.15
- Check whether untrusted input is inserted into regexes with static analysis. SonarSource provides rules for detecting this vulnerability, which can run in an IDE or continuous-integration pipeline. section 12.15
- Use a dedicated search index for rich user search syntax instead of evaluating untrusted input as a regex pattern. section 12.16 section 12.15
from flask import request, jsonify
from elasticsearch import Elasticsearch
es_client = Elasticsearch([ ELASTIC_SEARCH_URL ])
@app.route("/document", methods=["POST"])
def add_document():
data = request.get_json()
result = es_client.index(index="documents", body=data)
return jsonify({"message": "Document indexed"}), 201
@app.route("/search/<search_query>", methods=["GET"])
def search(search_query):
result = es_client.search(
index="documents",
body={"query":
{"match": {"content": search_query}}})
return jsonify({"results": result["hits"]["hits"]}), 200
This Flask example indexes documents and queries Elasticsearch with a match search, illustrating a dedicated search service in place of user-controlled regex evaluation. section 12.15
