Re:The “security.txt” proposal reached last step in the IETF...
by saagarjha on Wednesday December 11, 2019 @05:18PM
(#21767374)
libpcre is exactly the implementation I’m not talking about, because it supports too much. I think re2 doesn’t do backtracking, so it’s probably a better choice.
Re:The “security.txt” proposal reached last step in the IETF...
by wahern on Wednesday December 11, 2019 @05:25PM
(#21767434)
You can still easily blow up memory with unions, which makes it easy to lock up Linux, which notoriously performs poorly under memory pressure.
Re:The “security.txt” proposal reached last step in the IETF...
by lilyball on Wednesday December 11, 2019 @05:45PM
(#21767606)
A non-backtracking regex engine like re2 should be linear with respect to the regex size and can be configured with a memory budget.
Re:The “security.txt” proposal reached last step in the IETF...
by wahern on Wednesday December 11, 2019 @06:01PM
(#21767708)
The number of DFA states can explode exponentially. It's a real problem, especially if you're compiling untrusted expressions off the internet.
Evaluation is linear, but you're just evaluating your own password. In this scenario, it may make sense to just use a simple backtracking implementation, though as you alluded to early there aren't many simple ones around.
Web browsers are already running random expressions from the internet, but their regex implementations have proven the rule by being fodder from exploit writers. In any event, requiring a password manager to pull the engine from Firefox or Chrome wouldn't be cool. They're more likely to use libpcre or re2, but see above.
The NAPTR DNS record type uses regular expressions for domain rewriting: https://en.wikipedia.org/wiki/NAPTR_record Not many DNS libraries support that record type as it adds alot of problematic bloat.