Re: Safe user-facing pattern matching.

[Gé Weijers <ge@...>]

Many regular _expression_ implementations have added features that can't be implemented by a finite state automaton, and they end up requiring backtracking. Lua's "%bxy" feature is one of them, as are 'back references' in the search string: ^(.*)-\1$  (two equal strings separated by a hyphen)

This problem could be solved by using a regex implementation that limits itself to 'true' regular expressions that can be implemented by an FSA.

A very full featured one is:

https://github.com/google/re2

Downside: it's written in C++, it should still be fairly easy to add a simple interface wrapper to Lua.

Gé

On Fri, Mar 31, 2017 at 1:21 AM, Viacheslav Usov <via.usov@gmail.com> wrote:

On Thu, Mar 30, 2017 at 6:59 PM, tomas <tomas@tecgraf.puc-rio.br> wrote:

> But as you said, this "long running C function" could be a third-party one, thus there is no guarantee the flag will be checked, isn't it?

There is no guarantee, but when there is common "abort" API that third-party libraries can use, some of them will use it. Then anyone needing a sandboxed Lua environment can take those libraries that support it, patch those that do not, or develop something from scratch. With common API, all of that will inter-operate nicely.

Cheers,

V.

--

--

Gé