.NET

Describes how recheck checks a regular expression of the dotnet dialect.

Engine

recheck follows the syntax and the semantics of .NET 10's System.Text.RegularExpressions.Regex.

Settings

The dotnet dialect has no settings.

CLI

$ recheck --dialect=dotnet '/^(a|a)*$/'

JavaScript

import { check } from "recheck";

await check("^(a|a)*$", "", { dialect: "dotnet" });

Scala

import codes.quine.labs.recheck.ReDoS
import codes.quine.labs.recheck.common.Parameters
import codes.quine.labs.resyntax.dialect.Dialect

ReDoS.check("^(a|a)*$", "", Parameters(dialect = Dialect.DotNet))

Flags and Units

The matching unit is utf16 (see Matching Units).

recheck supports the following RegexOptions, written as the letters of their inline options.

Flag	RegexOptions	Inline	Notes
i	IgnoreCase	(?i)	In the invariant culture.
m	Multiline	(?m)
n	ExplicitCapture	(?n)
s	Singleline	(?s)
x	IgnorePatternWhitespace	(?x)

Syntax Limitations

The following constructs are not supported, and they are reported as unsupported.

• Balancing groups (e.g. (?<close-open>...)).
• Internal property names (e.g. \p{_xmlI}).

The RegexOptions RightToLeft, ECMAScript and NonBacktracking have no flag letter, so they cannot be given.

Approximations

• .NET has optimizations that recheck does not model, so an attack that recheck reports may not work on .NET, and the runtime-attack verification checks whether it does.
• \G matches only at the start of the input, since recheck models a search from there, not one from a later position (e.g. Match.NextMatch).
• Case-insensitive matching follows the invariant culture, not the current culture (e.g. (?i)i does not match İ as it does in the Turkish culture).

Runtime-Attack Verification

• Command: dotnet run <file>.cs.
• Matching: Regex.Match.
• Engine limits: none.
• Engine errors: OutOfMemoryException, InsufficientExecutionStackException.
• Environment variable: RECHECK_DOTNET.

dotnet runs the program as a file-based app, which needs a .NET 10 SDK or later.