Re^4: Is it safe to use external strings for regexes?

> is only allowed within the scope of use re 'eval'; with "newer" Perls yes. I noticed that you changed it around 2013, and am thankful for that. *

Um no, "use re 'eval'" has always been required to allow non-literal code blocks in patterns. The big "re eval" rewrite in 5.18.0 just made it smarter, so that for example a literal (and thus safe) code block could be interpolated into a run-time regex without needing the "use re 'eval'":

use re 'eval'; # ** no longer needed from 5.18.0 onwards
$r = qr/xyz/;
/(?{ foo() })$r/;
[download]

Dave.

Comment on Re^4: Is it safe to use external strings for regexes? Download Code

Replies are listed 'Best First'.
Re^5: Is it safe to use external strings for regexes? by LanX (Saint) on Oct 07, 2021 at 20:50 UTC
> just made it smarter ... without needing the "use re 'eval'": hm, we seem to be talking about different things please compare these threads Re: Vulnerabilities when editing untrusted code... (Komodo) Perl 5.17 change to use re 'eval' breaks Acme::EyeDrops They show that concatenating literal strings to form an eval group used to work out of the box without `use re 'eval'` . Both examples don't include any variables but rely on concats aka `.` In detail: Some optimizer converted this `''=~ ( '(?{B' . 'EGIN{print "owned"}})' )` into this at compile time `''=~ '(?{BEGIN{print "owned"}})'` without complaining. Now it requires `use re "eval"` Cheers Rolf _{(addicted to the Perl Programming Language :) Wikisyntax for the Monastery}	[reply] [d/l] [select]
Re^6: Is it safe to use external strings for regexes? by dave_the_m (Monsignor) on Oct 08, 2021 at 07:01 UTC
hm, we seem to be talking about different things I thought we were talking about using strings obtained from an external source (such as a file or DB) as a regex, and whether the (?{...}) feature could be exploited in that case. The example you gave of concatting two halves of a regex still requires the code to be literal in the source (albeit split) to not need 'use re eval' in the src code, even prior to 5.18.0. Dave.	[reply]
Re^7: Is it safe to use external strings for regexes? by LanX (Saint) on Oct 08, 2021 at 10:01 UTC
As I said, I'm thankful that your change rules out `''=~ ( '(?{B' . 'EGIN{print "owned"}})' )` to happen. Like this I have a chance to statically check for `BEGIN` or `use re` before running `perl -c` (sorry eyepopslikeamosquito :) Cheers Rolf _{(addicted to the Perl Programming Language :) Wikisyntax for the Monastery}	[reply] [d/l] [select]