3 ms·
Practical upshot: do not feed untrusted regexes into boost::regex.
by jimrandomh 10y ago
Practical upshot: do not feed untrusted regexes into boost::regex.
- jvoorhis 10y agoOr any untrusted user input for that matter?
- Groxx 10y agoUntrusted regexes to anything, where possible. There are fairly well-known ways to use those to run a DoS: https://en.wikipedia.org/wiki/ReDoS https://en.wikipedia.org/wiki/ReDoS
- stuckagain 10y agoI take it you don't use a web browser?
- lomnakkus 10y agoNot exactly sure what you're getting at, but web browsers these days have a lot of protection from malicious pages, including the "JavaScript on this page is using 100% cpu; terminate? Yes/No?" dialogs.
- Groxx 10y agoAnd I dislike it when it locks up, yes. Less impactful than a server-side DoS, but still decidedly ungood.
- kibwen 10y agoNote that it is possible to design regex engines that deliberately avoid these pitfalls (e.g. RE2, which was originally written for Google Code Search, as well as Go's regex engine (written by the RE2 author) and Rust's regex engine). The downside is that these engines are forced to disallow certain exploitable features, such as backtracking.