> So if the pattern is read from a file or database this isn't an issue.

As I said "In the latter case" of general vulnerabilities, these are some issues to be aware of.

The OP said

> > These regexes are in the dozens, and are scattered across several scripts and libraries.

> > maintenance of these mappings is easier.

I doubt the general case can be solved with a DB of simple strings. Maintainable regexes are composed of smaller ones by interpolation and dynamic compilation. Which brings us back to start.

> is only allowed within the scope of use re 'eval';

with "newer" Perls yes. I noticed that you changed it around 2013, and am thankful for that. *

> The third one is a genuine issue, in terms of both CPU and memory usage.

well some regex engines optimize sometimes better than Perl's.

I remember a demo of a case with nested quantifiers where unix' grep did very well and Perl waited for the end of times.

This could be eased by analyzing the regex for potential traps like listed here and warning accordingly.

This analyze could be done by parsing the compilation with re 'debug'; °

But again this could open the door for those general vulnerabilities, that's why I prefer to point to them.

Cheers Rolf
(addicted to the Perl Programming Language :)
Wikisyntax for the Monastery

°) for completeness TheDamian published a static parser for perl regexes, I can't tell how closely it incorporates new features.

*) Some IDEs do perl -c on default when they open a perl file. Sending a troyan script with a evil BEGIN block will execute instantly after opening. And obfuscation with Acme::EyeDrops will still allow hiding the evil logic into a regex, one just needs to add use re 'eval'; for newer Perls

In reply to Re^3: Is it safe to use external strings for regexes? by LanX
in thread Is it safe to use external strings for regexes? by stevieb

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.