Regular Expression Engine in 14 lines of Python

Re:Regular Expression Engine in 14 lines of Python by Figs on Sunday November 06, 2011 @08:55AM (#3202654)

> This still pops up once in a while, with some poor soul discovering the hard way that it's basically allowing arbitrary code execution.

Actually, wouldn't that just be a DoS vulnerability? The risk is that someone can request a command that will either take too long or use too much memory, but they can't do anything besides pure computation unless there are other bugs (e.g. buffer overrun) in the regex parser.

[ Parent | on HN ]

Re:Regular Expression Engine in 14 lines of Python by nknight on Sunday November 06, 2011 @09:50AM (#3202768)

There are other bugs in the engine. PCRE has had several, I have no reason to believe any other engine is not similarly vulnerable. In a security context, a regex engine is best viewed as a virtual machine. Most virtual machines are not secure in the face of hostile code.

[ Parent | on HN ]