6 ms·
If you really need the backtracking features in those other systems, the point is "never". Similarly, if you have short-lived regexes that are compiled, used f
by glangdale 9y ago
If you really need the backtracking features in those other systems, the point is "never".
Similarly, if you have short-lived regexes that are compiled, used for a small amount of data, and discarded, you might never see a performance benefit.
Multiple regexes, scanning a substantial amount of data and/or having a requirement to 'stream' (i.e. process successive writes of input data when you can't hold on to old data) are the sort of things that make Hyperscan use more sensible. We see a lot of use in network security where these assumptions all generally hold.
- Blackthorn 9y agoAlso, if you're taking in user input into a regex you want to use something like RE2 or Hyperscan. To do otherwise is to expose yourself to DoS.
- anentropic 9y agois that just because they don't support the features which can be used to make pathological regexes in other engines? or they have additional sanitisation or security features?
- glangdale 9y agoNeither. There are regexes that can be written in the common subset supported by (say) libpcre, RE2 and Hyperscan that will induce exponential backtracking with libpcre but not with the other libraries. I'm not aware of any difference in terms of sanitisation or security.