Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use secure alternatives for regex #176

Open
sunharis opened this issue Jan 15, 2021 · 2 comments
Open

Use secure alternatives for regex #176

sunharis opened this issue Jan 15, 2021 · 2 comments
Labels
enhancement New feature or request

Comments

@sunharis
Copy link
Contributor

We have been using the regex for validating an input string.

This issue is opened to address Ed's concern over the usage of regex -
Std::regex is slow, takes a lot of memory, and complicates things that should be simple. In most cases, there are much more performant alternatives that are more clear in code.

@edtanous
Copy link
Contributor

edtanous commented Feb 2, 2021

https://gerrit.openbmc-project.xyz/c/openbmc/bmcweb/+/35522

Performance is one concern, security and correctness are another. As part of this audit, it was found that most of the regexes we use were incorrect in some subtle way, or could be greatly simplified by either calling the libraries built-in string verification routines, or handling errors properly.

A good example of this is https://adtmag.com/Blogs/Dev-Watch/2016/07/stack-overflow-crash.aspx
A pretty simple regex took down all of stack overflow for a significant amount of time.

bmcweb should be avoiding issues like these.

@edtanous edtanous changed the title Use performant alternatives for regex Use secure alternatives for regex Feb 7, 2021
@edtanous edtanous added the enhancement New feature or request label Feb 7, 2021
@edtanous
Copy link
Contributor

Most uses of regex have been removed. For uses in non-deprecated options, there is one usage left in ethernet, which needs moved into the hostname-handling daemon.

https://github.com/openbmc/bmcweb/search?q=std%3A%3Aregex

bradbishop pushed a commit that referenced this issue May 25, 2023
Per [1] we really shouldn't be using regex.  In the cases we do, it's a
HUUUUUGE performance benefit to be compiling the regex ONCE.

The only downside is a slight increase in memory usage.

[1]: #176

Signed-off-by: Ed Tanous <[email protected]>
Change-Id: I8644b8a07810349fb60bfa0258a13e815912a38e
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants