4 ms·

The lesson seems to be "Always run trim() before running regex" and "validate content as much as possible before running regex".

undersuit 10y ago
Trim would not have worked, the post started with '-- play happy sound for player to enjoy', had 20000 characters of whitespace, and then some other character.
- shdon 10y ago
  Which also wouldn't have been caught by the regex, because it was designed to do the same as Trim. Given the input, all that whitespace was not actually supposed to be removed and the regex worked, it was just a degenerate case that slowed it down to a crawl. Trim would not slow down on this input.
  - undersuit 10y ago
    Trim won't work, otherwise SO would be using trim. The regex did work in all cases, but it was slow under certain conditions. The slowness caused a separate system to shutdown the site. The regex worked fine, 100% within expectations.
    - shdon 10y ago
      No, the regex was an actual trim. And they have indeed switched to that. The edge case that caused the slow performance was a lot of whitespace that did not appear at the start or end of the string. The regex would not remove that, nor would trim, but trim is much more efficient in doing the exact same thing. The regex may have been correct, but I doubt the expectations of the developer were met and it most definitely was the wrong tool for the job.
revelation 10y ago
Or just reject this input. The server isn't the time and place to do data cleanup. Can always fix this on the frontend with JavaScript for free if it's an actual problem.
- gortok 10y ago
  You can't trust that the user has JavaScript enabled; and since you can't trust user input anyway, you'd have to do this server side.
  - revelation 10y ago
    "You can't trust user input" means to not fudge with user data in the first place! If your code cares about unicode spaces at the beginning of user input, there is your problem. (Also, you missed the reject part)
    - maxgee 10y ago
      How would you suggest running a user-created-content site without ever fudging/sanitizing the data being posted to the server?
- corecoder 10y ago
  Sure you can, but you better clean up on server side, or find a way to prevent any of 7+ billion people from posting maliciously.
- dingo_bat 10y ago
  > Can always fix this on the frontend with JavaScript for free Nice to see what people think of offloading work to users' systems. This kind of thinking leads to slow ensures with fucked up scrolling.

undersuit 10y ago

Trim would not have worked, the post started with '-- play happy sound for player to enjoy', had 20000 characters of whitespace, and then some other character.

shdon 10y ago
Which also wouldn't have been caught by the regex, because it was designed to do the same as Trim. Given the input, all that whitespace was not actually supposed to be removed and the regex worked, it was just a degenerate case that slowed it down to a crawl. Trim would not slow down on this input.
- undersuit 10y ago
  Trim won't work, otherwise SO would be using trim. The regex did work in all cases, but it was slow under certain conditions. The slowness caused a separate system to shutdown the site. The regex worked fine, 100% within expectations.
  - shdon 10y ago
    No, the regex was an actual trim. And they have indeed switched to that. The edge case that caused the slow performance was a lot of whitespace that did not appear at the start or end of the string. The regex would not remove that, nor would trim, but trim is much more efficient in doing the exact same thing. The regex may have been correct, but I doubt the expectations of the developer were met and it most definitely was the wrong tool for the job.

revelation 10y ago

Or just reject this input. The server isn't the time and place to do data cleanup. Can always fix this on the frontend with JavaScript for free if it's an actual problem.

gortok 10y ago
You can't trust that the user has JavaScript enabled; and since you can't trust user input anyway, you'd have to do this server side.
- revelation 10y ago
  "You can't trust user input" means to not fudge with user data in the first place! If your code cares about unicode spaces at the beginning of user input, there is your problem. (Also, you missed the reject part)
  - maxgee 10y ago
    How would you suggest running a user-created-content site without ever fudging/sanitizing the data being posted to the server?
corecoder 10y ago
Sure you can, but you better clean up on server side, or find a way to prevent any of 7+ billion people from posting maliciously.
dingo_bat 10y ago
> Can always fix this on the frontend with JavaScript for free Nice to see what people think of offloading work to users' systems. This kind of thinking leads to slow ensures with fucked up scrolling.