Patched code sample

import re

def sanitize_datetime_input(user_input):
  """
  Sanitizes datetime input to prevent ReDoS.

  This function replaces the vulnerable regex with a safe and efficient method
  for validating and extracting information from user input. Instead of
  complex backtracking, it uses a combination of simple regex patterns and
  string splitting to achieve the desired functionality.  It now also uses
  a maximum input length to mitigate DoS attempts.

  Args:
    user_input: The user-provided datetime string.

  Returns:
    A tuple containing (valid, offset_value, offset_unit) where:
      valid: True if the input is valid, False otherwise.
      offset_value: The numeric offset value (int) if present, None otherwise.
      offset_unit: The offset unit (str) if present, None otherwise.

  """

  MAX_INPUT_LENGTH = 50  # Prevent excessively long inputs
  if len(user_input) > MAX_INPUT_LENGTH:
        return False, None, None

  # Basic check for "now"
  user_input = user_input.strip()
  if not user_input.startswith("now") and user_input != "":
      return False, None, None

  #If input is exactly "now", no further parsing needed
  if user_input == "now":
        return True, None, None

  # Check for "now - ..." pattern
  parts = user_input.split("-")
  if len(parts) > 2:
        return False, None, None

  if len(parts) == 1:
    return True, None, None #The case where the user input is only "now". Already handled previously, but left to make things very clear.


  # Extract offset part
  offset_part = parts[1].strip()

  # Extract value and unit using a simple regex
  match = re.match(r"(\d+)([dmhs])", offset_part)
  if not match:
      return False, None, None

  offset_value = int(match.group(1))
  offset_unit = match.group(2)

  return True, offset_value, offset_unit



# Example usage demonstrating fix against ReDoS

#Vulnerable Pattern: `^(?:\s*now\s*(?:-\s*(\d+)\s*([dmhs]))?)?\s*$`

#Test cases:
#This example shows a ReDoS exploitation attempt using a long sequence of spaces interspersed with "now" and "-". The original regex used backtracking to process this long string of data, which can take polynomial time to match, leading to a Denial of Service (DoS) condition on the server by consuming 100% CPU.
user_input_vuln = "now" + " " * 50 + "now" + " " * 50 + "now" + " " * 50 + "now" + " " * 50  + "now" #Example of a long string that triggers catastrophic backtracking on the vulnerable Regex

is_valid, offset, unit = sanitize_datetime_input(user_input_vuln)
print(f"Input: {user_input_vuln}, Valid: {is_valid}, Offset: {offset}, Unit: {unit}")

user_input_valid = "now - 10d" #Example of a valid user input
is_valid, offset, unit = sanitize_datetime_input(user_input_valid)
print(f"Input: {user_input_valid}, Valid: {is_valid}, Offset: {offset}, Unit: {unit}")

user_input_invalid = "now - abc" #Example of an invalid user input
is_valid, offset, unit = sanitize_datetime_input(user_input_invalid)
print(f"Input: {user_input_invalid}, Valid: {is_valid}, Offset: {offset}, Unit: {unit}")

user_input_now = "now" #Example of a user input of just "now"
is_valid, offset, unit = sanitize_datetime_input(user_input_now)
print(f"Input: {user_input_now}, Valid: {is_valid}, Offset: {offset}, Unit: {unit}")

user_input_empty = "" #Example of an empty user input
is_valid, offset, unit = sanitize_datetime_input(user_input_empty)
print(f"Input: {user_input_empty}, Valid: {is_valid}, Offset: {offset}, Unit: {unit}")

user_input_long = "now - 10d" * 10 #Example of a long user input string
is_valid, offset, unit = sanitize_datetime_input(user_input_long)
print(f"Input: {user_input_long}, Valid: {is_valid}, Offset: {offset}, Unit: {unit}") # This will return invalid because of max input length check.