3 ms·
All manner of problems in the programmers mind become trivial if only we allow users to input essentially code to express exactly what they want. Of course this
by revelation 10y ago
All manner of problems in the programmers mind become trivial if only we allow users to input essentially code to express exactly what they want. Of course this is basically never a good solution.
The issue with allowing arbitrary regex patterns is DoS through exponential blowup. But if you allow running code anyway you might not very much care for that.
- kbenson 10y agoAssuming untrue things about the mathematical properties of your regular expression engine which are not supported by the documentation and allowing that to be exploited by user input is a different beast entirely than a bug in that library. The first, with careful examination of the properties may be preventable through sanitation of the input to exclude certain edge cases. You can't assume you'll be able to sanitize input ahead of time for bugs nobody knows about yet, which might be hidden in normally safe features.
- Someone1234 10y agoDoS's can be limited by isolating the regular expression from the rest of the program and limiting its resource utilisation.