3 ms·
My first thought seeing this title: "Why, no. Next!" My second thought: the voice of Linus Torvalds at DebConf 14 saying "Hum… No! Hum… that was quick." [1] T
by jraph 7y ago
My first thought seeing this title: "Why, no. Next!"
My second thought: the voice of Linus Torvalds at DebConf 14 saying "Hum… No! Hum… that was quick." [1]
Though this is only speaking about a recursively defined regular expression language which is infinite, which strictly handles regular languages, as defined in computer science lessons in university.
And then, "Why not just try and see if it breaks the provided regex parser since you have one?", and it's actually one of the answers in the link… awesome. I wonder it is has security implications though (are forged regexes exploiting flawed regex parsers a thing?)
[1] https://youtu.be/5PmHRSeA2c8?t=110 https://youtu.be/5PmHRSeA2c8?t=110
- gpm 7y ago> are forged regexes exploiting flawed regex parsers a thing? Looks like yes, depending on the engine. PCRE for instance has a long list of security vulnerabilities including some with arbitrary code execution: https://www.cvedetails.com/vulnerability-list.php?vendor_id=3265&product_id=0&version_id=0&page=1&hasexp=0&opdos=1&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=0&cweid=0&order=1&trc=38&sha=3be670e89a2d45bd0df8736dd00d2179b59636da https://www.cvedetails.com/vulnerability-list.php?vendor_id=...