3 ms·
Regular expression engines are notoriously buggy. You definitely wouldn't want to pass random expressions to libpcre. Web browsers are already running random e
by wahern 7y ago
Regular expression engines are notoriously buggy. You definitely wouldn't want to pass random expressions to libpcre.
Web browsers are already running random expressions from the internet, but their regex implementations have proven the rule by being fodder from exploit writers. In any event, requiring a password manager to pull the engine from Firefox or Chrome wouldn't be cool. They're more likely to use libpcre or re2, but see above.
The NAPTR DNS record type uses regular expressions for domain rewriting: https://en.wikipedia.org/wiki/NAPTR_record https://en.wikipedia.org/wiki/NAPTR_record
Not many DNS libraries support that record type as it adds alot of problematic bloat.
- saagarjha 7y agolibpcre is exactly the implementation I’m not talking about, because it supports too much. I think re2 doesn’t do backtracking, so it’s probably a better choice.
- wahern 7y agoYou can still easily blow up memory with unions, which makes it easy to lock up Linux, which notoriously performs poorly under memory pressure.
- saagarjha 7y agoJust set a memory limit on the process.
- lilyball 7y agoA non-backtracking regex engine like re2 should be linear with respect to the regex size and can be configured with a memory budget.
- wahern 7y agoThe number of DFA states can explode exponentially. It's a real problem, especially if you're compiling untrusted expressions off the internet. Evaluation is linear, but you're just evaluating your own password. In this scenario, it may make sense to just use a simple backtracking implementation, though as you alluded to early there aren't many simple ones around.
- pjscott 7y agoRE2, at least, will fall back to an NFA-based matcher if things get too pathological.