Technical Specification: Free Regular Expression ReDoS Vulnerability Tester

Overview

A high-performance, browser-based utility designed to help developers identify potential Regular Expression Denial of Service (ReDoS) vulnerabilities. The tool provides static analysis of regex patterns to detect catastrophic backtracking risks, offering actionable feedback to improve regex safety and performance.

Core Features

• Pattern Analysis: Heuristic scanner to identify nested quantifiers, overlapping character classes, and exponential complexity signatures.
• Risk Meter: Visual indicator (Low/Medium/High) of vulnerability risk.
• Educational Explanations: Real-time feedback explaining why a pattern is dangerous, along with suggested refactoring techniques.
• Input Validation: Real-time syntax checking to ensure valid RegEx input.
• Client-Side Security: Zero-server architecture; all analysis occurs in the browser.

UI Layout

• Header: Simple, clean title "Regex Security Analyzer" with a descriptive subtitle.
• Main Interface:
  • Regex Input: A multi-line, monospaced textarea with syntax highlighting support.
  • Test String Input: A secondary field to optionally test against specific payloads.
  • Analysis Dashboard: A prominent area displaying the risk score, detailed analysis logs, and actionable recommendations.
• Information Area: An accordion-style section below the tool explaining best practices for writing secure regex.

Design System (Light Mode Only)

• Color Palette:
  • Primary: #2563eb (Professional Blue for UI elements).
  • Success/Safe: #16a34a (Green for secure patterns).
  • Warning/Danger: #dc2626 (Red for high-risk vulnerabilities).
  • Background: #f8fafc (Clean, light gray-blue).
  • Cards: #ffffff (White with crisp shadow effects: 0 4px 6px -1px rgb(0 0 0 / 0.1)).
• Typography: Inter or System Sans-Serif, focusing on readability for code snippets.
• Animations:
  • Subtle fade-in for results.
  • Smooth expansion for the educational accordion sections.
  • Responsive layout shifts (flex/grid) during window resizing.

Technical Implementation & Sandboxing

• Architecture: Single HTML file (HTML5/CSS3/Vanilla JS).
• Sandboxing Constraints:
  • Storage: No usage of localStorage, sessionStorage, or cookies. In-memory state only.
  • Communication: No fetch() or external APIs. All logic is contained within the page bundle.
  • DOM Handling: No prompt(), alert(), or confirm(). All interactions (errors, confirmation) are rendered via absolute-positioned modal divs.
  • External Dependencies: Only use trusted CDN links for libraries (e.g., Prism.js for syntax highlighting, Tailwind CSS for styling) via <link>/<script> tags.
• Efficiency: Ensure all regex analysis runs in a requestAnimationFrame loop or a non-blocking execution pattern to prevent browser UI freezing.