Using Node.js worker threads to guard against ReDoS attacks

worker_thread.js

'use strict'

const { Worker } = require('worker_threads')

const worker = new Worker(`
  const { workerData, parentPort } = require('worker_threads')
  const result = workerData.str.match(workerData.regex)
  parentPort.postMessage(result)
`, {
  workerData: {
    regex: /([a-z]+)+$/,
    str: 'aaaaaaaaaaaaaaaaaaaaaaaaaaa a' // without the space, the regex is fast, with the space it takes over 1s
  },
  eval: true
})

worker.on('message', result => {
  console.log(result)
})

worker.on('exit', code => {
  console.log('exit code', code)
  clearTimeout(timer)
})

const timer = setTimeout(() => {
  console.log('terminating worker')
  worker.terminate()
}, 1000)