Remove duplicated ReDoS fast-path filter from RegexGrammar; narrow at RegexFlowConfigs wrappers

Author: Copilot

cpp/ql/lib/semmle/code/cpp/regex/RegexFlowConfigs.qll

@@ -34,31 +34,50 @@ import semmle.code.cpp.regex.internal.StdRegex
 
 // ---------------------------------------------------------------------------
 // Re-exports from the flow-free grammar/flag module.
+//
 // These are kept in scope for backward compatibility so that consumers can
-// continue to import them from `RegexFlowConfigs`.
+// continue to import them from `RegexFlowConfigs`. They are narrowed here
+// to `ExploitableStringLiteral` — the same source set as the taint-tracking
+// configuration below — so the flag/grammar readers exposed at this layer
+// only report on regexes that are ReDoS-analysis candidates. The
+// underlying flow-free predicates in `RegexGrammar` are unrestricted; any
+// consumer wanting the full set can call them directly.
 // ---------------------------------------------------------------------------
 /** See `RegexGrammar::TRegexGrammar`. */
 class TRegexGrammar = RG::TRegexGrammar;
 
 /** See `RegexGrammar::regexGrammar`. */
-TRegexGrammar regexGrammar(StringLiteral regex) { result = RG::regexGrammar(regex) }
+TRegexGrammar regexGrammar(StringLiteral regex) {
+  regex instanceof ExploitableStringLiteral and
+  result = RG::regexGrammar(regex)
+}
 
 /** See `RegexGrammar::hasConcreteGrammar`. */
 predicate hasConcreteGrammar(TRegexGrammar grammar) { RG::hasConcreteGrammar(grammar) }
 
 /** See `RegexGrammar::hasIgnoreCaseFlag`. */
-predicate hasIgnoreCaseFlag(StringLiteral regex) { RG::hasIgnoreCaseFlag(regex) }
+predicate hasIgnoreCaseFlag(StringLiteral regex) {
+  regex instanceof ExploitableStringLiteral and
+  RG::hasIgnoreCaseFlag(regex)
+}
 
 /** See `RegexGrammar::hasMultilineFlag`. */
-predicate hasMultilineFlag(StringLiteral regex) { RG::hasMultilineFlag(regex) }
+predicate hasMultilineFlag(StringLiteral regex) {
+  regex instanceof ExploitableStringLiteral and
+  RG::hasMultilineFlag(regex)
+}
 
 /** See `RegexGrammar::hasNonEcmaScriptGrammarFlag`. */
 predicate hasNonEcmaScriptGrammarFlag(StringLiteral regex) {
+  regex instanceof ExploitableStringLiteral and
   RG::hasNonEcmaScriptGrammarFlag(regex)
 }
 
 /** See `RegexGrammar::hasEcmaScriptGrammarFlag`. */
-predicate hasEcmaScriptGrammarFlag(StringLiteral regex) { RG::hasEcmaScriptGrammarFlag(regex) }
+predicate hasEcmaScriptGrammarFlag(StringLiteral regex) {
+  regex instanceof ExploitableStringLiteral and
+  RG::hasEcmaScriptGrammarFlag(regex)
+}
 
 // ---------------------------------------------------------------------------
 // std::basic_regex type helpers

cpp/ql/lib/semmle/code/cpp/regex/internal/RegexGrammar.qll

@@ -23,27 +23,6 @@
 import cpp
 private import semmle.code.cpp.regex.internal.StdRegex
 
-// ---------------------------------------------------------------------------
-// Fast-path filter: only consider literals that *look* regex-y
-// ---------------------------------------------------------------------------
-/**
- * Holds if `s` is a plausible ReDoS-candidate string literal value: it
- * contains at least one unbounded-repetition quantifier (`+`, `*`, or
- * `{n,}`).
- *
- * This mirrors the source restriction of the dataflow configuration in
- * `RegexFlowConfigs` (whose sources are the `ExploitableStringLiteral`s),
- * so that the flag readers below consider exactly the same set of regexes
- * as the taint-tracking configuration. Inlined here as a syntactic check
- * to keep this module flow-free.
- */
-private predicate isExploitableStringLiteralValue(StringLiteral s) {
-  exists(string v | v = s.getValue() |
-    v.regexpMatch(".*[+*].*") or
-    v.regexpMatch(".*\\{[0-9]+,[0-9]*\\}.*")
-  )
-}
-
 // ---------------------------------------------------------------------------
 // Construction-site flag readers (std::regex_constants enum plumbing)
 // ---------------------------------------------------------------------------
@@ -108,32 +87,23 @@ private predicate isPatternLiteralOf(StringLiteral regex, Expr patternArg) {
  *
  * This association is purely syntactic (no dataflow): the pattern literal
  * must appear inside the constructor/assign call's first argument.
- *
- * Restricted to string literals that look like plausible ReDoS candidates
- * (see `isExploitableStringLiteralValue`) to preserve the exact set of
- * regexes considered by the flag readers when they were routed through
- * the taint-tracking configuration (whose sources are the same
- * `ExploitableStringLiteral` set).
  */
 private Expr getConstructionFlagArg(StringLiteral regex) {
-  isExploitableStringLiteralValue(regex) and
-  (
-    // basic_regex(pattern, flags) constructor - both named-variable and
-    // temporary constructions are covered because the search for `regex`
-    // is done syntactically inside the constructor's first argument.
-    exists(ConstructorCall cc |
-      cc.getTarget().getDeclaringType() instanceof StdBasicRegex and
-      isPatternLiteralOf(regex, cc.getArgument(0)) and
-      result = cc.getArgument(1)
-    )
-    or
-    // basic_regex::assign(pattern, flags).
-    exists(FunctionCall fc |
-      fc.getTarget().(MemberFunction).getDeclaringType() instanceof StdBasicRegex and
-      fc.getTarget().hasName("assign") and
-      isPatternLiteralOf(regex, fc.getArgument(0)) and
-      result = fc.getArgument(1)
-    )
+  // basic_regex(pattern, flags) constructor - both named-variable and
+  // temporary constructions are covered because the search for `regex`
+  // is done syntactically inside the constructor's first argument.
+  exists(ConstructorCall cc |
+    cc.getTarget().getDeclaringType() instanceof StdBasicRegex and
+    isPatternLiteralOf(regex, cc.getArgument(0)) and
+    result = cc.getArgument(1)
+  )
+  or
+  // basic_regex::assign(pattern, flags).
+  exists(FunctionCall fc |
+    fc.getTarget().(MemberFunction).getDeclaringType() instanceof StdBasicRegex and
+    fc.getTarget().hasName("assign") and
+    isPatternLiteralOf(regex, fc.getArgument(0)) and
+    result = fc.getArgument(1)
   )
 }