Hacker News

points by couchand 1 day ago | 0 comments

It's a Bad Idea (TM) to compile a regular expression from an untrusted input.

Despite what anyone would try to sell you, a regular expression is a programming language. It's Always A Bad Idea (TM) to compile untrusted input into any kind of programming language. Don't string concatenate SQL queries, eval is evil, it's all the same idea.

[–] Blackthorn 1 day ago

A regex might be a programming language, a proper regular expression (which there are libraries for, like Google RE2) is just a regular language and I don't think you can even charitably call that a programming language.

[–] luhn 15 hours ago

What's the difference between regex and regular expression? I always understood the former to be an abbreviation for the latter.

[–] OJFord 15 hours ago

It is but what they mean is that many implementations (e.g. PCRE) are not actually regular languages, they're more powerful: https://www.npopov.com/2012/06/15/The-true-power-of-regular-...

[–] Gigachad 22 hours ago

Despite this Ruby should have requested CVE numbers. They created a patch that was available to install and prevented this attack. CVE numbers would have triggered automations to update Ruby in everyones systems.

[–] rendaw 1 day ago

Why is it a bad idea, for either of those? Fundamentally?

[–] quibono 22 hours ago

Yes, after all there is no distinction between data and code since they're the same thing when it comes down to the bytes in memory.

[–] milkshakes 1 day ago

> It's a Bad Idea (TM) to compile a regular expression from an untrusted input.

i agree with you!

nevertheless,

> where we nevertheless treated a double free in Regexp compilation as a vulnerability after a comprehensive assessment

not sure what sort of comprehensive assessment is still called for at this point?