3 ms·
I agree with (2). (1) is in theory right, but it's very rare to see it done. The only one I'm aware of actually doing a "switch between linear time and unbound
by burntsushi 4y ago
I agree with (2).
(1) is in theory right, but it's very rare to see it done. The only one I'm aware of actually doing a "switch between linear time and unbounded backtracking" is Tcl, and I'm not familiar enough with it to know if it actually gives any guarantees.
The difficulty in (1) is rooted in: 1) implementation complexity, 2) performance and 3) match semantics. (1)+(2) are related, and indeed, if you want your linear time engine to compete with your backtracker engine, you're going to need to do a fair bit of work. (3) is also quite tricky. Cox's RE2 paves the path for how to get linear time engines to mostly agree with backtrackers, but there may be some corner cases where there is some disagreement. So for something like Python, (3) may be quite difficult to overcome.
Popping up a level, I'm not sure how relevant all of this is to your overall point. As the author of Rust's regex crate, I actually generally agree with your post, insomuch as catastrophic backtracking is handled as a security vulnerability. I'm mostly just picking at nits and elaborating here.
- woodruffw 4y agoYeah, agreed -- (1) isn't exactly commonplace. That point was originally meant to fit into an extended section of the post on reporting format imprecision, i.e. our current inability to express anything more precise than "this dependency is exploitable, you need to upgrade it" with existing vulnerability formats and feeds. Not being able to automatically filter by implementation variance or context-sensitivity fall under that. But I then trimmed that section so this point is mostly irrelevant to the larger post, as you said!
- burntsushi 4y ago> our current inability to express anything more precise than "this dependency is exploitable, you need to upgrade it" Oof, yes. I know this pain.