undefined | Better HN

0 pointsj1elo2y ago0 comments

> The regex crate doesn't support arbitrary look-around because it isn't known how to implement efficiently.

A bit of a philosophical question:

If how to write an efficient implementation is yet not known to man, ie. not a matter of the library's author time or skills, but literally a limit on human knowledge: why not at least provide the functionality with a good enough implementation? (with caveats just possibly mentioned in documentation)

IMHO that'd be arguably a good thing for everybody, at a minimum better than just not offering the possibility at all. Which drives users to frustration, or leaves them having to discover a more pragmatic alternative lib that opted to add it.

This is no complaint or feature request... I just want to learn from some insight behind the thought process of "if it's not efficient, better not have it at all"

PS. Thanks for the link. Now I have a good read for the weekend, for sure!

0 comments

burntsushi2y ago

ReDoS is one answer. Another answer is that it would effectively require supporting another regex engine with very different semantics internally. That's a tall order, and with the existence of fancy-regex (and other engines), there's no real compelling reason to do it.

You don't need to be all things to all people. Embrace the fact that there are other choices!

fsociety2y ago

Because it is a mechanism for ReDOS, and the standard library should not be introducing vulnerabilities into users. Other libraries can implement it for folks who decide they really need it.

uxp8u61q2y ago

You need to put a time limit on your regex execution no matter what, if you're parsing untrusted input.

burntsushi2y ago

Not necessarily. But it's complicated. See: https://docs.rs/regex/latest/regex/#untrusted-input

One of the key advantages of a regex engine based on finite automata is that it lets you make guarantees about the runtime performance of a search.

1 more reply

j / k navigate · click thread line to collapse

0 pointsj1elo2y ago0 comments

> The regex crate doesn't support arbitrary look-around because it isn't known how to implement efficiently.

A bit of a philosophical question:

This is no complaint or feature request... I just want to learn from some insight behind the thought process of "if it's not efficient, better not have it at all"

PS. Thanks for the link. Now I have a good read for the weekend, for sure!

0 comments

burntsushi2y ago

You don't need to be all things to all people. Embrace the fact that there are other choices!

fsociety2y ago

Because it is a mechanism for ReDOS, and the standard library should not be introducing vulnerabilities into users. Other libraries can implement it for folks who decide they really need it.

uxp8u61q2y ago

You need to put a time limit on your regex execution no matter what, if you're parsing untrusted input.

burntsushi2y ago

Not necessarily. But it's complicated. See: https://docs.rs/regex/latest/regex/#untrusted-input

One of the key advantages of a regex engine based on finite automata is that it lets you make guarantees about the runtime performance of a search.

1 more reply

j / k navigate · click thread line to collapse