So today at work I found out about the possibility of exploitable regular expressions. The basic premise, from what I understood, is that one could craft a string that, when matched against a vulnerable regex, could drain a lot of processing power and even make an application hang, effectively performing a DoS. More information here.
My goal is to fix the vulnerable regex we currently have. We're using Java so I'm pretty sure that's the PCRE flavor:
(?=http)\d*\w*\S*(?:\.xsd)
My number one question is: is there a way to algorithmically fix this regex without any knowledge about the strings it's going