undefined | Better HN

0 pointsfsociety2y ago0 comments

Because it is a mechanism for ReDOS, and the standard library should not be introducing vulnerabilities into users. Other libraries can implement it for folks who decide they really need it.

0 comments

uxp8u61q2y ago

You need to put a time limit on your regex execution no matter what, if you're parsing untrusted input.

burntsushi2y ago

Not necessarily. But it's complicated. See: https://docs.rs/regex/latest/regex/#untrusted-input

One of the key advantages of a regex engine based on finite automata is that it lets you make guarantees about the runtime performance of a search.

1 more reply

j / k navigate · click thread line to collapse