  Regular expression denial of service (ReDoS) is an asymmetric cyberattack
that has become prominent in recent years. Many research works examine ReDoS,
measuring its impact or preventing its exploitation. However, there has been no
systematic treatment of this topic in order to understand the limits of the
state of the art and identify opportunities for further research.
  In this paper, we fill this gap by systematizing the existing knowledge on
ReDoS. We review the algorithmic basis of ReDoS attacks and the pertinent
history of regular expression engines. Next, we survey the literature, dividing
works into two classes: measurement studies and defenses. We find no
agreed-upon definition for ReDoS vulnerabilities, and observe weaknesses in the
practical evaluations of many papers, making the impact of their findings hard
to assess. The majority of academic work in this area limit themselves to
showing the presence of an unexpected slow computation, without illustrating
how this can be weaponized against real systems. Then, we survey the latest
regex engines to examine whether and how the proposed defenses have been
realized. In this way, we describe the new realities that should be considered
in the next generation ReDoS research. We show that many academic threat models
are out of date thanks to the adoption of defenses. Beyond this, we underscore
the importance of simulating ReDoS attacks in realistic contexts, where factors
like request size limiting or deployed mitigations are taken into account. We
propose a tool, wrk-DoS, to facilitate these simulations.
