demo · v135

Code injection fuzzer

A curated list of nasty inputs — ReDoS patterns, alternation bombs, anchors, lookaheads — runs against three handlers: naive concatenation, hand-rolled escaping, and RegExp.escape. The table flags where each handler over-matches, throws, or hangs (handled via timeout).