The polynomial ReDoS query couldn't detect vulnerabilities in Apache Commons Lang3 RegExUtils methods because they use the plain regex-use sink kind, while regexSinkKindInfo only parsed bracketed forms like regex-use[0].

Changes

• Extended regexSinkKindInfo predicate to handle plain regex-use with defaults: non-full-string matching, string argument at index 0
• Updated comment in org.apache.commons.lang3.model.yml to document the behavior
• Added test coverage for all RegExUtils methods in polynomial ReDoS test suite

Technical Details

The plain regex-use kind is used by methods where both pattern and input are provided in a single call, like RegExUtils.removeAll(text, regex). The defaults (full=false, strArg=0) match this signature pattern where the regex is at Argument[1] and the text to match is at Argument[0].

This preserves the existing behavior where regex injection and polynomial ReDoS queries select different sink kinds to avoid false positives, while enabling the ReDoS query to analyze these methods.

private predicate regexSinkKindInfo(string kind, boolean full, int strArg) {
 sinkModel(_, _, _, _, _, _, _, kind, _, _) and
 (
 exists(string fullStr, string strArgStr | /* bracketed forms */ ) 
 or
 // Plain regex-use sinks default to non-full-string matching with string arg at index 0
 kind = "regex-use" and full = false and strArg = 0
 )
}

Created from VS Code via the GitHub Pull Request extension.

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.