Hacker News Reader

Comment by couchand | Hacker News Reader

It's a Bad Idea (TM) to compile a regular expression from an untrusted input.

Despite what anyone would try to sell you, a regular expression is a programming language. It's Always A Bad Idea (TM) to compile untrusted input into any kind of programming language. Don't string concatenate SQL queries, eval is evil, it's all the same idea.

View on HN

A regex might be a programming language, a proper regular expression (which there are libraries for, like Google RE2) is just a regular language and I don't think you can even charitably call that a programming language.

What's the difference between regex and regular expression? I always understood the former to be an abbreviation for the latter.

It is but what they mean is that many implementations (e.g. PCRE) are not actually regular languages, they're more powerful: https://www.npopov.com/2012/06/15/The-true-power-of-regular-...

Despite this Ruby should have requested CVE numbers. They created a patch that was available to install and prevented this attack. CVE numbers would have triggered automations to update Ruby in everyones systems.

Why is it a bad idea, for either of those? Fundamentally?

Yes, after all there is no distinction between data and code since they're the same thing when it comes down to the bytes in memory.

> It's a Bad Idea (TM) to compile a regular expression from an untrusted input.

i agree with you!

nevertheless,

> where we nevertheless treated a double free in Regexp compilation as a vulnerability after a comprehensive assessment

not sure what sort of comprehensive assessment is still called for at this point?

Reply on news.ycombinator.com