in reply to Re: matching a regular expression
in thread matching a regular expression

That's a good trick, as long as the user's input is trusted; otherwise it may cause arbitrary perl code to execute. If you filtered their input to only letters and numbers, it would be safe.

Update:ikegami points out that this is only true if use re 'eval'; is on, and perlre(1) confirms this. \Q/\E should help with the possibility of creating a really slow regex, and reduce the chances of tickling a bug in Perl's regex engion that turns out to be exploitable.


--
sgifford's Web page

Replies are listed 'Best First'.
Re^3: matching a regular expression
by ikegami (Patriarch) on May 18, 2006 at 16:31 UTC

    That's not true. Without use re 'eval', it won't execute Perl code. 

    my $input = '(?{ print("Hello World!\\n") })';

print(qq{Without "use re 'eval';":\n});
eval {
   '' =~ /$input/;
};
warn($@) if $@;

print("\n");

print(qq{With "use re 'eval';":\n});
eval {
   use re 'eval';
   '' =~ /$input/;
};
warn("Died: $@") if $@;

    [download]

    outputs 

    Without "use re 'eval';":
Died: Eval-group not allowed at runtime, use re 'eval' in regex m/(?{ 
+print("Hello World!\n") })/.

With "use re 'eval';":
Hello World!

    [download]

    On the other hand, some regexps take forever to execute. Some might even crash perl.

[reply]
[d/l]
[select]
Re^3: matching a regular expression
by Jasper (Chaplain) on May 18, 2006 at 15:59 UTC
    Ah, yes, I see what you mean. Easily solved with a \Q, though.
[reply]
[d/l]
Re^3: matching a regular expression
by blazar (Canon) on May 18, 2006 at 15:56 UTC

    Well said: just one more reason to use index instead of a regexp that fundamentally "emulates" index.

[reply]
      I know this is pedantic, but index() doesn't stop looking after it fails to find the target at position 0 of the string. The regex does. The regex fails very fast. Add a \Q...\E and an /i modifier, and you have a perfectly reasonable solution. And, as my solution above showed, you can get more bang for your buck.
      Jeff japhy Pinyan, P.L., P.M., P.O.D, X.S.: Perl, regex, and perl hacker
      How can we ever be the sold short or the cheated, we who for every service have long ago been overpaid? ~~ Meister Eckhart
[reply]
[d/l]

        Gawd, I can trust you on the reputation of your expertise, but however pedantic you like to be... is that relevant in any way?!?

[reply]
      Unless you wanted case insensitive indexing, which I'm not sure exists.

      You're being far too dismissive of the usefulness of a regex, I think.
[reply]
[reply]

In Section Seekers of Perl Wisdom