Rule Definition
The application stores data in a database. At a later time, the data is subsequently read back into the application and included in a Regular expression without sanitization.

Remediation
Use authorized sanitization methods, limit the computation time of the Regular expression.

Violation Code Sample

string login; // value given by a database access
string password = textBoxPassword.Text;
var regex = new Regex(login);
if (regex.Match(password).Success)
    MessageBox.Show("ERROR: the name must not be present in the password");
else
    MessageBox.Show("Correct password");

Fixed Code Sample

string login; // value given by a database access
string password = textBoxPassword.Text;
var regex = new Regex(Regex.Escape(login));
if (regex.Match(password).Success)
    MessageBox.Show("ERROR: the name must not be present in the password");
else
    MessageBox.Show("Correct password");

Regular expression Denial of Service - ReDoS https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS CWE-400: Uncontrolled Resource Consumption https://cwe.mitre.org/data/definitions/400.html Weaknesses in the 2019 CWE Top 25 Most Dangerous Software Errors https://cwe.mitre.org/data/definitions/1200.html