Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ReDoS: add a shared regex pack #11061

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

erik-krogh
Copy link
Contributor

@erik-krogh erik-krogh commented Nov 1, 2022

This PR introduces a new shared regex pack containing various shared code that analyze regular expressions.
All these analyses depend on a single RegexTreeViewSig signature, that describes a regex as a tree structure.

I don't expect that a shared regex parser will ever make it into this pack.

This is just the shared pack, there are separate PRs that will integrate this shared pack with each language (see bottom).
A complete PR, that combines all the part, can be found here: #10604 (ugly commit history).

I ended up basing locations on hasLocationInfo as not all languages had Location objects for all the regex terms.
This also required some small rewrites in the implementation.

The class hierarchy inside RegexTreeViewSig was needed in order to have some hierarchy that all the languages could agree on, and that's why I had to introduce a Top class.
(RegExpParent has a slightly different hierarchy in JS).


This PR should only be merged when a stable CLI supports all the required features, and when all the major core bugs have been fixed.


I've made separate PRs that port each language to the shared pack:
JavaScript, Ruby, Python, Java.


TODO:

@erik-krogh erik-krogh marked this pull request as ready for review Nov 1, 2022
@erik-krogh erik-krogh requested a review from a team Nov 1, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

1 participant