I recently found a redos vulnerability in the tarfile library: https://github.com/python/cpython/commit/34ddb64d088dd7ccc321f6103d23153256caa5d4 and this got me thinking if there are any other gems in the python codebase.
I wrote up this quick little tool which uses another tool to find redos vulnerable regexes in a codebase: https://github.com/personnumber3377/regexchecking
So let’s see what we can find…