Add isBacktrackingEngine gate excluding awk/grep/egrep from C++ ReDoS queries

Author: Copilot

cpp/ql/lib/change-notes/2026-07-17-cpp-regex-non-backtracking-engine.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The C++ ReDoS queries (`cpp/redos` and `cpp/polynomial-redos`) now treat regexes constructed with the `std::regex_constants::awk`, `grep`, or `egrep` grammar flags as non-backtracking, and exclude them from analysis. These POSIX tool-style grammars correspond to traditionally linear-time (DFA-based) matching semantics, so super-linear-backtracking ReDoS does not apply. The `basic` (BRE) and `extended` (ERE) grammars remain backtracking-eligible. Grammar selection and ReDoS-eligibility are exposed as independent axes via the new `isBacktrackingEngine` predicate in `semmle.code.cpp.regex.RegexFlowConfigs`.

cpp/ql/lib/semmle/code/cpp/regex/RegexFlowConfigs.qll

@@ -382,3 +382,30 @@ predicate hasNonEcmaScriptGrammarFlag(StringLiteral regex) {
 predicate hasEcmaScriptGrammarFlag(StringLiteral regex) {
   containsRegexFlag(getConstructionFlagArg(regex), "ECMAScript")
 }
+
+/**
+ * Holds if `regex` is constructed with a POSIX tool-style grammar flag
+ * (`awk`, `grep`, or `egrep`) that we treat as linear-time / non-backtracking.
+ */
+private predicate hasNonBacktrackingGrammarFlag(StringLiteral regex) {
+  containsRegexFlag(getConstructionFlagArg(regex), ["awk", "grep", "egrep"])
+}
+
+/**
+ * Holds if `regex` is used with a `std::regex` matching engine that performs
+ * backtracking, so that super-linear-backtracking ReDoS is possible.
+ *
+ * `std::regex` backtracks for the ECMAScript, `basic` (BRE), and `extended`
+ * (ERE) grammars. The POSIX tool-style grammars `awk`, `grep`, and `egrep`
+ * are treated as linear-time (non-backtracking) matching semantics for the
+ * purposes of the ReDoS queries and are excluded here.
+ *
+ * Grammar selection and ReDoS-eligibility are independent axes: two flags
+ * can select the same grammar yet differ in ReDoS-eligibility (for example
+ * `extended` and `egrep` both parse as ERE, but only `extended` is
+ * backtracking-eligible).
+ */
+predicate isBacktrackingEngine(StringLiteral regex) {
+  usedAsRegex(regex) and
+  not hasNonBacktrackingGrammarFlag(regex)
+}

cpp/ql/lib/semmle/code/cpp/security/regexp/ExponentialReDoSQuery.qll

@@ -18,4 +18,25 @@
 
 import semmle.code.cpp.regex.RegexTreeView
 private import semmle.code.cpp.regex.RegexTreeView::RegexTreeView as TreeView
-import codeql.regex.nfa.ExponentialBackTracking::Make<TreeView>
+private import codeql.regex.nfa.ExponentialBackTracking
+private import semmle.code.cpp.regex.RegexFlowConfigs
+
+private module Impl = Make<TreeView>;
+
+/** A state of the NFA constructed for a regular expression. */
+class State = Impl::State;
+
+/**
+ * Holds if `t` is a regex term whose worst-case matching is exponential in
+ * the input length, with `pump` being an example pumping string that
+ * triggers the backtracking from state `s`, and `prefixMsg` describing any
+ * required prefix.
+ *
+ * The result is restricted to terms whose root regex satisfies
+ * `isBacktrackingEngine`, so that regexes constructed with a non-backtracking
+ * `std::regex` grammar flag (`awk`, `grep`, or `egrep`) are excluded.
+ */
+predicate hasReDoSResult(RegExpTerm t, string pump, State s, string prefixMsg) {
+  Impl::hasReDoSResult(t, pump, s, prefixMsg) and
+  isBacktrackingEngine(t.getRootTerm().getLiteral().getRegex())
+}

cpp/ql/lib/semmle/code/cpp/security/regexp/PolynomialReDoSQuery.qll

@@ -28,6 +28,7 @@ class PolynomialRedosSink extends DataFlow::Node {
   PolynomialRedosSink() {
     exists(Expr e |
       regexMatchedAgainst(reg.getRegex(), e) and
+      isBacktrackingEngine(reg.getRegex()) and
       (this.asExpr() = e or this.asIndirectExpr() = e)
     )
   }

cpp/ql/test/query-tests/Security/CWE/CWE-1333-ReDoS/test.cpp

@@ -262,5 +262,33 @@ int main(int argc, char** argv) {
     // discussion in the accompanying PR.
     { std::regex re("^([[:punct:]]+)+$"); run(re, input); }
 
+    // -------------------------------------------------------------------------
+    // 10. Non-backtracking POSIX tool-style grammars (`awk`, `grep`, `egrep`)
+    //     combined with other flags via bitwise-OR.
+    //
+    // Regression guard: these must remain excluded from cpp/redos once a
+    // future phase relaxes the parser to accept non-ECMAScript grammars, via
+    // the `isBacktrackingEngine` gate. The equivalent default-grammar
+    // patterns (section 2 above) fire, showing that the gate — not some
+    // unrelated exclusion — suppresses these cases.
+    //
+    // Today the parser also drops all non-ECMAScript grammar literals, so
+    // these cases would be suppressed regardless; the query-level gate is a
+    // regression guard for the parser-relaxation phase.
+    // -------------------------------------------------------------------------
+
+    // GOOD: awk grammar — non-backtracking.
+    { std::regex re("^([a-z]+)+$", std::regex_constants::awk); run(re, input); }
+    // GOOD: grep grammar combined with icase — non-backtracking.
+    { std::regex re("^([a-z]+)+$",
+                    (std::regex_constants::syntax_option_type)
+                    (std::regex_constants::grep | std::regex_constants::icase));
+      run(re, input); }
+    // GOOD: egrep grammar combined with icase — non-backtracking.
+    { std::regex re("^([a-z]+)+$",
+                    (std::regex_constants::syntax_option_type)
+                    (std::regex_constants::egrep | std::regex_constants::icase));
+      run(re, input); }
+
     return 0;
 }

cpp/ql/test/query-tests/Security/CWE/CWE-1333/test.cpp

@@ -421,5 +421,40 @@ int main(int argc, char** argv) {
         std::regex_match(input, re);
     }
 
+    // -------------------------------------------------------------------------
+    // 11. Non-backtracking POSIX tool-style grammars (`awk`, `grep`, `egrep`)
+    //     combined with other flags via bitwise-OR.
+    //
+    // Regression guard: these must remain excluded from cpp/polynomial-redos
+    // once a future phase relaxes the parser to accept non-ECMAScript
+    // grammars, via the `isBacktrackingEngine` gate. The equivalent
+    // default-grammar patterns above fire, showing that the gate — not some
+    // unrelated exclusion — suppresses these cases.
+    //
+    // Today the parser also drops all non-ECMAScript grammar literals, so
+    // these cases would be suppressed regardless; the query-level gate is a
+    // regression guard for the parser-relaxation phase.
+    // -------------------------------------------------------------------------
+
+    // GOOD: awk grammar — non-backtracking.
+    {
+        std::regex re("^\\s+|\\s+$", std::regex_constants::awk);
+        std::regex_replace(input, re, std::string(""));
+    }
+    // GOOD: grep grammar combined with icase — non-backtracking.
+    {
+        std::regex re("^\\s+|\\s+$",
+                      (std::regex_constants::syntax_option_type)
+                      (std::regex_constants::grep | std::regex_constants::icase));
+        std::regex_replace(input, re, std::string(""));
+    }
+    // GOOD: egrep grammar combined with icase — non-backtracking.
+    {
+        std::regex re("^\\s+|\\s+$",
+                      (std::regex_constants::syntax_option_type)
+                      (std::regex_constants::egrep | std::regex_constants::icase));
+        std::regex_replace(input, re, std::string(""));
+    }
+
     return 0;
 }