Search code examples
regexsecuritylanguage-features

In which languages is it a security hole to use user-supplied regular expression?


Edit: tchrist has informed me that my original accusations about Perl's insecurity are unfounded. However, the question still stands.

I know that in Perl, you can embed arbitrary code in a regular expression, so obviously accepting a user-supplied regex and matching it allows arbitrary code execution and is a clear security hole. But is this true for all languages that use regular expressions? Is it true for all languages that use "Perl-compatible" regular expressions? In which languages are user-supplied regexes safe to use, and in which languages do they allow arbitrary code execution or other security holes?


Solution

  • In most languages allowing users to supply regular expression means that you allow for a denial of service attack.

    Some types of regular expressions are extremely cpu intensive to execute. So in general it's a bad idea to allow users to enter regular expressions that will be executed on a remote system.

    For more info, read this page: http://www.regular-expressions.info/catastrophic.html