SonarQube ReDoS finding is a security hotspot, not a vulnerability

TL;DR: If you do fix it, options include rewriting the regex to avoid nested quantifiers and catastrophic backtracking, or replacing regex date validation with real date parsing (new Date with explicit format checks), which kills the ReDoS class entirely. Context: Stack Overflow #61478960 (accepted answer, 34 votes): SonarQube flags a date-validation regex in JavaScript as a Regular expression Denial of Service (ReDoS) security issue.

Fix

1. If you do fix it, options include rewriting the regex to avoid nested quantifiers and catastrophic backtracking, or replacing regex date validation with real date parsing (new Date with explicit format checks), which kills the ReDoS class entirely. Expected: this specific failure stops.

Details

Context: Stack Overflow #61478960 (accepted answer, 34 votes): SonarQube flags a date-validation regex in JavaScript as a Regular expression Denial of Service (ReDoS) security issue. The asker pasted a long date regex and is treating the finding as a confirmed vulnerability. [accepted answer]: first, read the finding type. SonarQube reports this as a security HOTSPOT, not a vulnerability. A hotspot highlights security-sensitive code you need to review; it is not a confirmed exploitable problem. The workflow is: review the flagged regex, decide whether backtracking on hostile input is actually reachable in your code, and either mark it reviewed (no threat) or fix it.

When to use

You hit exactly this: SonarQube ReDoS finding is a security hotspot, not a vulnerability.

When not to use

A different error, or the same symptom in a different tool. This page only covers the failure above.

Compatibility

the tool named in the title.

Root cause

Dont treat every hotspot as a CVE, but dont close it without looking either.

Stack Overflow #61478960 (accepted answer, 34 votes): SonarQube flags a date-validation regex in JavaScript as a Regular expression Denial of Service (ReDoS) security issue. The asker pasted a long date regex and is treating the finding as a confirmed vulnerability.

Verified resolution: [accepted answer]: first, read the finding type. SonarQube reports this as a security HOTSPOT, not a vulnerability. A hotspot highlights security-sensitive code you need to review; it is not a confirmed exploitable problem. The workflow is: review the flagged regex, decide whether backtracking on hostile input is actually reachable in your code, and either mark it reviewed (no threat) or fix it. If you do fix it, options include rewriting the regex to avoid nested quantifiers and catastrophic backtracking, or replacing regex date validation with real date parsing (new Date with explicit format checks), which kills the ReDoS class entirely. Dont treat every hotspot as a CVE, but dont close it without looking either.

Source: https://stackoverflow.com/questions/61478960