note 129220 added to regexp.reference.performance

> Beware of patterns that contain nested indefinite repeats. These can take a long time to run > when applied to a string that does not match. To say that it takes a "long time" is an understatement: the time taken would be exponential, specifically 2^n, where n is the number of "a" characters. This behavior could lead to a "regular expression denial of service" (ReDoS) if you run such a expression on user-provided input. To not be hit by ReDoS, do one (or maybe more than one) of the three things: * Write your expression so that it is not vulnerable. https://www.regular-expressions.info/redos.html is a good resource (both the "atomic" and "possessive" options are available in PHP/PCRE). Use a "ReDoS detector" or "regex linter" if your eyeballs can't catch all the issues. * Set up some limits for preg_match. Use ini_set(...) on the values mentioned on https://www.php.net/manual/en/pcre.configuration.php. Reducing the limits might cause regexes to fail, but that is usually better than stalling your whole server. * Use a different regex implementation. There used to be an RE2 extension; not any more! ---- Server IP: 45.112.84.4 Probable Submitter: 45.91.157.134 (proxied: 103.142.141.94) ---- Manual Page -- https://php.net/manual/en/regexp.reference.performance.php Edit -- https://main.php.net/note/edit/129220 Del: integrated -- https://main.php.net/note/delete/129220/integrated Del: useless -- https://main.php.net/note/delete/129220/useless Del: bad code -- https://main.php.net/note/delete/129220/bad+code Del: spam -- https://main.php.net/note/delete/129220/spam Del: non-english -- https://main.php.net/note/delete/129220/non-english Del: in docs -- https://main.php.net/note/delete/129220/in+docs Del: other reasons-- https://main.php.net/note/delete/129220 Reject -- https://main.php.net/note/reject/129220 Search -- https://main.php.net/manage/user-notes.php