|
532
|
1 |
% Chapter 1
|
|
|
2 |
|
|
|
3 |
\chapter{Introduction} % Main chapter title
|
|
|
4 |
|
|
|
5 |
\label{Introduction} % For referencing the chapter elsewhere, use \ref{Chapter1}
|
|
|
6 |
|
|
|
7 |
%----------------------------------------------------------------------------------------
|
|
|
8 |
|
|
|
9 |
% Define some commands to keep the formatting separated from the content
|
|
|
10 |
\newcommand{\keyword}[1]{\textbf{#1}}
|
|
|
11 |
\newcommand{\tabhead}[1]{\textbf{#1}}
|
|
|
12 |
\newcommand{\code}[1]{\texttt{#1}}
|
|
|
13 |
\newcommand{\file}[1]{\texttt{\bfseries#1}}
|
|
|
14 |
\newcommand{\option}[1]{\texttt{\itshape#1}}
|
|
|
15 |
|
|
|
16 |
%boxes
|
|
|
17 |
\newcommand*{\mybox}[1]{\framebox{\strut #1}}
|
|
|
18 |
|
|
|
19 |
%\newcommand{\sflataux}[1]{\textit{sflat}\_\textit{aux} \, #1}
|
|
|
20 |
\newcommand\sflat[1]{\llparenthesis #1 \rrparenthesis }
|
|
|
21 |
\newcommand{\ASEQ}[3]{\textit{ASEQ}_{#1} \, #2 \, #3}
|
|
543
|
22 |
\newcommand{\bderssimp}[2]{#1 \backslash_{bsimps} #2}
|
|
596
|
23 |
\newcommand{\rderssimp}[2]{#1 \backslash_{rsimps} #2}
|
|
564
|
24 |
\def\derssimp{\textit{ders}\_\textit{simp}}
|
|
557
|
25 |
\def\rders{\textit{rders}}
|
|
532
|
26 |
\newcommand{\bders}[2]{#1 \backslash #2}
|
|
|
27 |
\newcommand{\bsimp}[1]{\textit{bsimp}(#1)}
|
|
591
|
28 |
\def\bsimps{\textit{bsimp}}
|
|
554
|
29 |
\newcommand{\rsimp}[1]{\textit{rsimp}\; #1}
|
|
532
|
30 |
\newcommand{\sflataux}[1]{\llparenthesis #1 \rrparenthesis'}
|
|
|
31 |
\newcommand{\dn}{\stackrel{\mbox{\scriptsize def}}{=}}%
|
|
|
32 |
\newcommand{\denote}{\stackrel{\mbox{\scriptsize denote}}{=}}%
|
|
|
33 |
\newcommand{\ZERO}{\mbox{\bf 0}}
|
|
|
34 |
\newcommand{\ONE}{\mbox{\bf 1}}
|
|
|
35 |
\newcommand{\AALTS}[2]{\oplus {\scriptstyle #1}\, #2}
|
|
555
|
36 |
\newcommand{\rdistinct}[2]{\textit{rdistinct} \;\; #1 \;\; #2}
|
|
594
|
37 |
\def\rdistincts{\textit{rdistinct}}
|
|
556
|
38 |
\def\rDistinct{\textit{rdistinct}}
|
|
532
|
39 |
\newcommand\hflat[1]{\llparenthesis #1 \rrparenthesis_*}
|
|
|
40 |
\newcommand\hflataux[1]{\llparenthesis #1 \rrparenthesis_*'}
|
|
|
41 |
\newcommand\createdByStar[1]{\textit{createdByStar}(#1)}
|
|
|
42 |
|
|
|
43 |
\newcommand\myequiv{\mathrel{\stackrel{\makebox[0pt]{\mbox{\normalfont\tiny equiv}}}{=}}}
|
|
|
44 |
|
|
600
|
45 |
\def\SEQ{\textit{SEQ}}
|
|
|
46 |
\def\SEQs{\textit{SEQs}}
|
|
564
|
47 |
\def\case{\textit{case}}
|
|
554
|
48 |
\def\sequal{\stackrel{\mbox{\scriptsize rsimp}}{=}}
|
|
|
49 |
\def\rsimpalts{\textit{rsimp}_{ALTS}}
|
|
|
50 |
\def\good{\textit{good}}
|
|
|
51 |
\def\btrue{\textit{true}}
|
|
|
52 |
\def\bfalse{\textit{false}}
|
|
542
|
53 |
\def\bnullable{\textit{bnullable}}
|
|
543
|
54 |
\def\bnullables{\textit{bnullables}}
|
|
538
|
55 |
\def\Some{\textit{Some}}
|
|
|
56 |
\def\None{\textit{None}}
|
|
537
|
57 |
\def\code{\textit{code}}
|
|
532
|
58 |
\def\decode{\textit{decode}}
|
|
|
59 |
\def\internalise{\textit{internalise}}
|
|
|
60 |
\def\lexer{\mathit{lexer}}
|
|
|
61 |
\def\mkeps{\textit{mkeps}}
|
|
557
|
62 |
\newcommand{\rder}[2]{#2 \backslash_r #1}
|
|
532
|
63 |
|
|
585
|
64 |
\def\rerases{\textit{rerase}}
|
|
|
65 |
|
|
554
|
66 |
\def\nonnested{\textit{nonnested}}
|
|
532
|
67 |
\def\AZERO{\textit{AZERO}}
|
|
558
|
68 |
\def\sizeNregex{\textit{sizeNregex}}
|
|
532
|
69 |
\def\AONE{\textit{AONE}}
|
|
|
70 |
\def\ACHAR{\textit{ACHAR}}
|
|
|
71 |
|
|
585
|
72 |
\def\simpsulz{\textit{simp}_{Sulz}}
|
|
|
73 |
|
|
557
|
74 |
\def\scfrewrites{\stackrel{*}{\rightsquigarrow_{scf}}}
|
|
555
|
75 |
\def\frewrite{\rightsquigarrow_f}
|
|
|
76 |
\def\hrewrite{\rightsquigarrow_h}
|
|
|
77 |
\def\grewrite{\rightsquigarrow_g}
|
|
|
78 |
\def\frewrites{\stackrel{*}{\rightsquigarrow_f}}
|
|
|
79 |
\def\hrewrites{\stackrel{*}{\rightsquigarrow_h}}
|
|
|
80 |
\def\grewrites{\stackrel{*}{\rightsquigarrow_g}}
|
|
538
|
81 |
\def\fuse{\textit{fuse}}
|
|
|
82 |
\def\bder{\textit{bder}}
|
|
542
|
83 |
\def\der{\textit{der}}
|
|
532
|
84 |
\def\POSIX{\textit{POSIX}}
|
|
|
85 |
\def\ALTS{\textit{ALTS}}
|
|
|
86 |
\def\ASTAR{\textit{ASTAR}}
|
|
|
87 |
\def\DFA{\textit{DFA}}
|
|
538
|
88 |
\def\NFA{\textit{NFA}}
|
|
532
|
89 |
\def\bmkeps{\textit{bmkeps}}
|
|
543
|
90 |
\def\bmkepss{\textit{bmkepss}}
|
|
532
|
91 |
\def\retrieve{\textit{retrieve}}
|
|
|
92 |
\def\blexer{\textit{blexer}}
|
|
|
93 |
\def\flex{\textit{flex}}
|
|
573
|
94 |
\def\inj{\textit{inj}}
|
|
564
|
95 |
\def\Empty{\textit{Empty}}
|
|
567
|
96 |
\def\Left{\textit{Left}}
|
|
|
97 |
\def\Right{\textit{Right}}
|
|
573
|
98 |
\def\Stars{\textit{Stars}}
|
|
|
99 |
\def\Char{\textit{Char}}
|
|
|
100 |
\def\Seq{\textit{Seq}}
|
|
532
|
101 |
\def\Der{\textit{Der}}
|
|
|
102 |
\def\Ders{\textit{Ders}}
|
|
|
103 |
\def\nullable{\mathit{nullable}}
|
|
|
104 |
\def\Z{\mathit{Z}}
|
|
|
105 |
\def\S{\mathit{S}}
|
|
|
106 |
\def\rup{r^\uparrow}
|
|
|
107 |
%\def\bderssimp{\mathit{bders}\_\mathit{simp}}
|
|
|
108 |
\def\distinctWith{\textit{distinctWith}}
|
|
|
109 |
\def\lf{\textit{lf}}
|
|
|
110 |
\def\PD{\textit{PD}}
|
|
|
111 |
\def\suffix{\textit{Suffix}}
|
|
543
|
112 |
\def\distinctBy{\textit{distinctBy}}
|
|
558
|
113 |
\def\starupdate{\textit{starUpdate}}
|
|
|
114 |
\def\starupdates{\textit{starUpdates}}
|
|
|
115 |
|
|
532
|
116 |
|
|
|
117 |
\def\size{\mathit{size}}
|
|
|
118 |
\def\rexp{\mathbf{rexp}}
|
|
|
119 |
\def\simp{\mathit{simp}}
|
|
|
120 |
\def\simpALTs{\mathit{simp}\_\mathit{ALTs}}
|
|
|
121 |
\def\map{\mathit{map}}
|
|
|
122 |
\def\distinct{\mathit{distinct}}
|
|
|
123 |
\def\blexersimp{\mathit{blexer}\_\mathit{simp}}
|
|
590
|
124 |
\def\blexerStrong{\textit{blexerStrong}}
|
|
|
125 |
\def\bsimpStrong{\textit{bsimpStrong}}
|
|
591
|
126 |
\def\bdersStrongs{\textit{bdersStrong}}
|
|
590
|
127 |
\newcommand{\bdersStrong}[2]{#1 \backslash_{bsimpStrongs} #2}
|
|
|
128 |
|
|
532
|
129 |
\def\map{\textit{map}}
|
|
|
130 |
\def\rrexp{\textit{rrexp}}
|
|
554
|
131 |
\newcommand\rnullable[1]{\textit{rnullable} \; #1 }
|
|
532
|
132 |
\newcommand\rsize[1]{\llbracket #1 \rrbracket_r}
|
|
|
133 |
\newcommand\asize[1]{\llbracket #1 \rrbracket}
|
|
543
|
134 |
\newcommand\rerase[1]{ (#1)_{\downarrow_r}}
|
|
|
135 |
|
|
538
|
136 |
\newcommand\ChristianComment[1]{\textcolor{blue}{#1}\\}
|
|
532
|
137 |
|
|
543
|
138 |
|
|
|
139 |
\def\rflts{\textit{rflts}}
|
|
|
140 |
\def\rrewrite{\textit{rrewrite}}
|
|
|
141 |
\def\bsimpalts{\textit{bsimp}_{ALTS}}
|
|
596
|
142 |
\def\bsimpaseq{\textit{bsimp}_{ASEQ}}
|
|
|
143 |
\def\rsimlalts{\textit{rsimp}_{ALTs}}
|
|
|
144 |
\def\rsimpseq{\textit{rsimp}_{SEQ}}
|
|
543
|
145 |
|
|
532
|
146 |
\def\erase{\textit{erase}}
|
|
|
147 |
\def\STAR{\textit{STAR}}
|
|
|
148 |
\def\flts{\textit{flts}}
|
|
|
149 |
|
|
|
150 |
|
|
579
|
151 |
\def\zeroable{\textit{zeroable}}
|
|
|
152 |
\def\nub{\textit{nub}}
|
|
|
153 |
\def\filter{\textit{filter}}
|
|
601
|
154 |
%\def\not{\textit{not}}
|
|
579
|
155 |
|
|
|
156 |
|
|
|
157 |
|
|
532
|
158 |
\def\RZERO{\mathbf{0}_r }
|
|
|
159 |
\def\RONE{\mathbf{1}_r}
|
|
|
160 |
\newcommand\RCHAR[1]{\mathbf{#1}_r}
|
|
|
161 |
\newcommand\RSEQ[2]{#1 \cdot #2}
|
|
558
|
162 |
\newcommand\RALTS[1]{\sum #1}
|
|
532
|
163 |
\newcommand\RSTAR[1]{#1^*}
|
|
558
|
164 |
\newcommand\vsuf[2]{\textit{Suffix} \;#1\;#2}
|
|
532
|
165 |
|
|
538
|
166 |
|
|
|
167 |
|
|
590
|
168 |
|
|
|
169 |
\lstdefinestyle{myScalastyle}{
|
|
|
170 |
frame=tb,
|
|
|
171 |
language=scala,
|
|
|
172 |
aboveskip=3mm,
|
|
|
173 |
belowskip=3mm,
|
|
|
174 |
showstringspaces=false,
|
|
|
175 |
columns=flexible,
|
|
|
176 |
basicstyle={\small\ttfamily},
|
|
|
177 |
numbers=none,
|
|
|
178 |
numberstyle=\tiny\color{gray},
|
|
|
179 |
keywordstyle=\color{blue},
|
|
|
180 |
commentstyle=\color{dkgreen},
|
|
|
181 |
stringstyle=\color{mauve},
|
|
|
182 |
frame=single,
|
|
|
183 |
breaklines=true,
|
|
|
184 |
breakatwhitespace=true,
|
|
|
185 |
tabsize=3,
|
|
538
|
186 |
}
|
|
|
187 |
|
|
590
|
188 |
|
|
532
|
189 |
%----------------------------------------------------------------------------------------
|
|
|
190 |
%This part is about regular expressions, Brzozowski derivatives,
|
|
|
191 |
%and a bit-coded lexing algorithm with proven correctness and time bounds.
|
|
|
192 |
|
|
|
193 |
%TODO: look up snort rules to use here--give readers idea of what regexes look like
|
|
|
194 |
|
|
601
|
195 |
|
|
|
196 |
|
|
|
197 |
|
|
|
198 |
|
|
|
199 |
|
|
|
200 |
Regular expressions are widely used in computer science:
|
|
|
201 |
be it in text-editors \parencite{atomEditor} with syntax highlighting and auto-completion;
|
|
|
202 |
command-line tools like $\mathit{grep}$ that facilitate easy
|
|
|
203 |
text-processing; network intrusion
|
|
|
204 |
detection systems that reject suspicious traffic; or compiler
|
|
|
205 |
front ends--the majority of the solutions to these tasks
|
|
|
206 |
involve lexing with regular
|
|
|
207 |
expressions.
|
|
|
208 |
Given its usefulness and ubiquity, one would imagine that
|
|
|
209 |
modern regular expression matching implementations
|
|
|
210 |
are mature and fully studied.
|
|
602
|
211 |
Indeed, in a popular programming language's regex engine,
|
|
|
212 |
supplying it with regular expressions and strings,
|
|
|
213 |
in most cases one can
|
|
|
214 |
get the matching information in a very short time.
|
|
|
215 |
Those matchers can be blindingly fast--some
|
|
|
216 |
network intrusion detection systems
|
|
601
|
217 |
use regex engines that are able to process
|
|
|
218 |
megabytes or even gigabytes of data per second \parencite{Turo_ov__2020}.
|
|
602
|
219 |
However, those matchers can exhibit a surprising security vulnerability
|
|
|
220 |
under a certain class of inputs.
|
|
|
221 |
%However, , this is not the case for $\mathbf{all}$ inputs.
|
|
601
|
222 |
%TODO: get source for SNORT/BRO's regex matching engine/speed
|
|
|
223 |
|
|
603
|
224 |
|
|
|
225 |
Take $(a^*)^*\,b$ and ask whether
|
|
|
226 |
strings of the form $aa..a$ match this regular
|
|
|
227 |
expression. Obviously this is not the case---the expected $b$ in the last
|
|
|
228 |
position is missing. One would expect that modern regular expression
|
|
|
229 |
matching engines can find this out very quickly. Alas, if one tries
|
|
|
230 |
this example in JavaScript, Python or Java 8, even with strings of a small
|
|
|
231 |
length, say around 30 $a$'s,
|
|
|
232 |
the decision takes crazy time to finish (graph \ref{fig:aStarStarb}).
|
|
|
233 |
This is clearly exponential behaviour, and
|
|
|
234 |
is triggered by some relatively simple regex patterns.
|
|
|
235 |
Java 9 and newer
|
|
|
236 |
versions improves this behaviour, but is still slow compared
|
|
|
237 |
with the approach we are going to use.
|
|
|
238 |
|
|
|
239 |
|
|
|
240 |
|
|
|
241 |
|
|
|
242 |
This superlinear blowup in regular expression engines
|
|
|
243 |
had repeatedly caused grief in real life that they
|
|
|
244 |
get a name for them--``catastrophic backtracking''.
|
|
|
245 |
For example, on 20 July 2016 one evil
|
|
|
246 |
regular expression brought the webpage
|
|
|
247 |
\href{http://stackexchange.com}{Stack Exchange} to its
|
|
|
248 |
knees.\footnote{\url{https://stackstatus.net/post/147710624694/outage-postmortem-july-20-2016}(Last accessed in 2019)}
|
|
|
249 |
In this instance, a regular expression intended to just trim white
|
|
|
250 |
spaces from the beginning and the end of a line actually consumed
|
|
|
251 |
massive amounts of CPU resources---causing web servers to grind to a
|
|
|
252 |
halt. In this example, the time needed to process
|
|
|
253 |
the string was $O(n^2)$ with respect to the string length. This
|
|
|
254 |
quadratic overhead was enough for the homepage of Stack Exchange to
|
|
|
255 |
respond so slowly that the load balancer assumed a $\mathit{DoS}$
|
|
|
256 |
attack and therefore stopped the servers from responding to any
|
|
|
257 |
requests. This made the whole site become unavailable.
|
|
|
258 |
|
|
601
|
259 |
\begin{figure}[p]
|
|
532
|
260 |
\begin{tabular}{@{}c@{\hspace{0mm}}c@{\hspace{0mm}}c@{}}
|
|
|
261 |
\begin{tikzpicture}
|
|
|
262 |
\begin{axis}[
|
|
|
263 |
xlabel={$n$},
|
|
|
264 |
x label style={at={(1.05,-0.05)}},
|
|
|
265 |
ylabel={time in secs},
|
|
|
266 |
enlargelimits=false,
|
|
|
267 |
xtick={0,5,...,30},
|
|
|
268 |
xmax=33,
|
|
|
269 |
ymax=35,
|
|
|
270 |
ytick={0,5,...,30},
|
|
|
271 |
scaled ticks=false,
|
|
|
272 |
axis lines=left,
|
|
|
273 |
width=5cm,
|
|
|
274 |
height=4cm,
|
|
|
275 |
legend entries={JavaScript},
|
|
|
276 |
legend pos=north west,
|
|
|
277 |
legend cell align=left]
|
|
|
278 |
\addplot[red,mark=*, mark options={fill=white}] table {re-js.data};
|
|
|
279 |
\end{axis}
|
|
|
280 |
\end{tikzpicture}
|
|
|
281 |
&
|
|
|
282 |
\begin{tikzpicture}
|
|
|
283 |
\begin{axis}[
|
|
|
284 |
xlabel={$n$},
|
|
|
285 |
x label style={at={(1.05,-0.05)}},
|
|
|
286 |
%ylabel={time in secs},
|
|
|
287 |
enlargelimits=false,
|
|
|
288 |
xtick={0,5,...,30},
|
|
|
289 |
xmax=33,
|
|
|
290 |
ymax=35,
|
|
|
291 |
ytick={0,5,...,30},
|
|
|
292 |
scaled ticks=false,
|
|
|
293 |
axis lines=left,
|
|
|
294 |
width=5cm,
|
|
|
295 |
height=4cm,
|
|
|
296 |
legend entries={Python},
|
|
|
297 |
legend pos=north west,
|
|
|
298 |
legend cell align=left]
|
|
|
299 |
\addplot[blue,mark=*, mark options={fill=white}] table {re-python2.data};
|
|
|
300 |
\end{axis}
|
|
|
301 |
\end{tikzpicture}
|
|
|
302 |
&
|
|
|
303 |
\begin{tikzpicture}
|
|
|
304 |
\begin{axis}[
|
|
|
305 |
xlabel={$n$},
|
|
|
306 |
x label style={at={(1.05,-0.05)}},
|
|
|
307 |
%ylabel={time in secs},
|
|
|
308 |
enlargelimits=false,
|
|
|
309 |
xtick={0,5,...,30},
|
|
|
310 |
xmax=33,
|
|
|
311 |
ymax=35,
|
|
|
312 |
ytick={0,5,...,30},
|
|
|
313 |
scaled ticks=false,
|
|
|
314 |
axis lines=left,
|
|
|
315 |
width=5cm,
|
|
|
316 |
height=4cm,
|
|
|
317 |
legend entries={Java 8},
|
|
|
318 |
legend pos=north west,
|
|
|
319 |
legend cell align=left]
|
|
|
320 |
\addplot[cyan,mark=*, mark options={fill=white}] table {re-java.data};
|
|
|
321 |
\end{axis}
|
|
|
322 |
\end{tikzpicture}\\
|
|
601
|
323 |
\begin{tikzpicture}
|
|
|
324 |
\begin{axis}[
|
|
|
325 |
xlabel={$n$},
|
|
|
326 |
x label style={at={(1.05,-0.05)}},
|
|
|
327 |
ylabel={time in secs},
|
|
|
328 |
enlargelimits=false,
|
|
|
329 |
xtick={0,5,...,30},
|
|
|
330 |
xmax=33,
|
|
|
331 |
ymax=35,
|
|
|
332 |
ytick={0,5,...,30},
|
|
|
333 |
scaled ticks=false,
|
|
|
334 |
axis lines=left,
|
|
|
335 |
width=5cm,
|
|
|
336 |
height=4cm,
|
|
|
337 |
legend entries={Dart},
|
|
|
338 |
legend pos=north west,
|
|
|
339 |
legend cell align=left]
|
|
|
340 |
\addplot[green,mark=*, mark options={fill=white}] table {re-dart.data};
|
|
|
341 |
\end{axis}
|
|
|
342 |
\end{tikzpicture}
|
|
|
343 |
&
|
|
|
344 |
\begin{tikzpicture}
|
|
|
345 |
\begin{axis}[
|
|
|
346 |
xlabel={$n$},
|
|
|
347 |
x label style={at={(1.05,-0.05)}},
|
|
|
348 |
%ylabel={time in secs},
|
|
|
349 |
enlargelimits=false,
|
|
|
350 |
xtick={0,5,...,30},
|
|
|
351 |
xmax=33,
|
|
|
352 |
ymax=35,
|
|
|
353 |
ytick={0,5,...,30},
|
|
|
354 |
scaled ticks=false,
|
|
|
355 |
axis lines=left,
|
|
|
356 |
width=5cm,
|
|
|
357 |
height=4cm,
|
|
|
358 |
legend entries={Swift},
|
|
|
359 |
legend pos=north west,
|
|
|
360 |
legend cell align=left]
|
|
|
361 |
\addplot[purple,mark=*, mark options={fill=white}] table {re-swift.data};
|
|
|
362 |
\end{axis}
|
|
|
363 |
\end{tikzpicture}
|
|
|
364 |
& \\
|
|
|
365 |
\multicolumn{3}{c}{Graphs}
|
|
532
|
366 |
\end{tabular}
|
|
601
|
367 |
\caption{Graphs showing runtime for matching $(a^*)^*\,b$ with strings
|
|
|
368 |
of the form $\protect\underbrace{aa..a}_{n}$ in various existing regular expression libraries.
|
|
|
369 |
The reason for their superlinear behaviour is that they do a depth-first-search.
|
|
|
370 |
If the string does not match, the engine starts to explore all possibilities.
|
|
|
371 |
}\label{fig:aStarStarb}
|
|
|
372 |
\end{figure}\afterpage{\clearpage}
|
|
538
|
373 |
|
|
532
|
374 |
A more recent example is a global outage of all Cloudflare servers on 2 July
|
|
|
375 |
2019. A poorly written regular expression exhibited exponential
|
|
|
376 |
behaviour and exhausted CPUs that serve HTTP traffic. Although the outage
|
|
|
377 |
had several causes, at the heart was a regular expression that
|
|
|
378 |
was used to monitor network
|
|
538
|
379 |
traffic.\footnote{\url{https://blog.cloudflare.com/details-of-the-cloudflare-outage-on-july-2-2019/}(Last accessed in 2022)}
|
|
532
|
380 |
These problems with regular expressions
|
|
|
381 |
are not isolated events that happen
|
|
|
382 |
very occasionally, but actually widespread.
|
|
|
383 |
They occur so often that they get a
|
|
|
384 |
name--Regular-Expression-Denial-Of-Service (ReDoS)
|
|
|
385 |
attack.
|
|
538
|
386 |
\citeauthor{Davis18} detected more
|
|
532
|
387 |
than 1000 super-linear (SL) regular expressions
|
|
|
388 |
in Node.js, Python core libraries, and npm and pypi.
|
|
|
389 |
They therefore concluded that evil regular expressions
|
|
538
|
390 |
are problems "more than a parlour trick", but one that
|
|
532
|
391 |
requires
|
|
|
392 |
more research attention.
|
|
|
393 |
|
|
603
|
394 |
This work aims to address this issue
|
|
|
395 |
with the help of formal proofs.
|
|
|
396 |
We offer a lexing algorithm based
|
|
|
397 |
on Brzozowski derivatives with certified correctness (in
|
|
|
398 |
Isabelle/HOL)
|
|
|
399 |
and finiteness property.
|
|
604
|
400 |
Such properties guarantee the absence of
|
|
603
|
401 |
catastrophic backtracking in most cases.
|
|
604
|
402 |
We will give more details in the next sections
|
|
|
403 |
on (i) why the slow cases in graph \ref{fig:aStarStarb}
|
|
|
404 |
can occur
|
|
|
405 |
and (ii) why we choose our
|
|
|
406 |
approach (Brzozowski derivatives and formal proofs).
|
|
602
|
407 |
|
|
603
|
408 |
|
|
604
|
409 |
\section{Terminology, and the Problem with Bounded Repetitions}
|
|
601
|
410 |
Regular expressions and regular expression matchers
|
|
|
411 |
have of course been studied for many, many years.
|
|
604
|
412 |
Theoretical results in automata theory says
|
|
|
413 |
that basic regular expression matching should be linear
|
|
|
414 |
w.r.t the input, provided that the regular expression
|
|
|
415 |
$r$ had been pre-processed and turned into a
|
|
|
416 |
deterministic finite automata (DFA).
|
|
|
417 |
By basic we mean textbook definitions such as the one
|
|
|
418 |
below, involving only characters, alternatives,
|
|
|
419 |
sequences, and Kleene stars:
|
|
|
420 |
\[
|
|
|
421 |
r ::= \ZERO | \ONE | c | r_1 + r_2 | r_1 \cdot r_2 | r^*
|
|
|
422 |
\]
|
|
|
423 |
Modern regular expression matchers used by programmers,
|
|
|
424 |
however,
|
|
|
425 |
support richer constructs such as bounded repetitions
|
|
|
426 |
and back-references.
|
|
|
427 |
The syntax and expressive power of those
|
|
|
428 |
matching engines
|
|
|
429 |
make ``regular expressions'' quite different from
|
|
|
430 |
their original meaning in the formal languages
|
|
|
431 |
theory.
|
|
|
432 |
To differentiate, people tend to use the word \emph{regex} to refer
|
|
|
433 |
those expressions with richer constructs, and regular expressions
|
|
|
434 |
for the more traditional meaning.
|
|
|
435 |
For example, the PCRE standard (Peral Compatible Regular Expressions)
|
|
|
436 |
is such a regex syntax standard.
|
|
|
437 |
We follow this convention in this thesis.
|
|
|
438 |
We aim to support all the popular features of regexes in the future,
|
|
|
439 |
but for this work we mainly look at regular expressions.
|
|
|
440 |
|
|
|
441 |
\subsection{A Little Introduction to Regexes: Bounded Repetitions
|
|
|
442 |
and Back-references}
|
|
|
443 |
Regexes come with a lot of constructs
|
|
|
444 |
that makes it more convenient for
|
|
|
445 |
programmers to write regular expressions.
|
|
|
446 |
Some of those constructs are syntactic sugars that are
|
|
|
447 |
simply short hand notations
|
|
|
448 |
that save the programmers a few keystrokes,
|
|
|
449 |
for example the
|
|
|
450 |
non-binary alternative involving three or more choices:
|
|
|
451 |
\[
|
|
|
452 |
r = (a | b | c | \ldots | z)^*
|
|
|
453 |
\]
|
|
|
454 |
, the range operator $-$ which means the alternative
|
|
|
455 |
of all characters between its operands:
|
|
|
456 |
\[
|
|
|
457 |
r = [0-9a-zA-Z] \; \text{(all alpha-numeric characters)}
|
|
|
458 |
\]
|
|
|
459 |
and the
|
|
|
460 |
wildcard character $.$ meaning any character
|
|
|
461 |
\[
|
|
|
462 |
. = [0-9a-zA-Z+-()*&\ldots]
|
|
|
463 |
|
|
|
464 |
\]
|
|
|
465 |
Some of those constructs do make the expressions much
|
|
|
466 |
more compact, and matching time could be greatly increase.
|
|
|
467 |
For example, $r^{n}$ is exponentially more concise compared with
|
|
|
468 |
the expression $\underbrace{r}_\text{n copies of r}$,
|
|
|
469 |
and therefore a naive algorithm that simply unfolds
|
|
|
470 |
$r^{n}$ into $\underbrace{r}_\text{n copies of r}$
|
|
|
471 |
will suffer exponential runtime increase.
|
|
|
472 |
Some constructs can even raise the expressive
|
|
|
473 |
power to the non-regular realm, for example
|
|
|
474 |
the back-references.
|
|
|
475 |
|
|
|
476 |
bounded repetitions, as we have discussed in the
|
|
|
477 |
previous section.
|
|
|
478 |
This super-linear behaviour of the
|
|
|
479 |
regex matching engines we have?
|
|
601
|
480 |
One of the most recent work in the context of lexing
|
|
|
481 |
is the Verbatim lexer by Egolf, Lasser and Fisher\cite{Verbatim}.
|
|
|
482 |
This is relevant work and we will compare later on
|
|
|
483 |
our derivative-based matcher we are going to present.
|
|
|
484 |
There is also some newer work called
|
|
|
485 |
Verbatim++\cite{Verbatimpp}, this does not use derivatives, but automaton instead.
|
|
602
|
486 |
For that the problem is dealing with the bounded regular expressions of the form
|
|
|
487 |
$r^{n}$ where $n$ is a constant specifying that $r$ must repeat
|
|
603
|
488 |
exactly $n$ times. The Verbatim++ lexer becomes excruciatingly slow
|
|
|
489 |
on the bounded repetitions construct.
|
|
|
490 |
|
|
|
491 |
In the work reported in \cite{CSL2022} and here, we add better support
|
|
|
492 |
for them.
|
|
602
|
493 |
The other repetition constructs include
|
|
603
|
494 |
$r^{\ldots m}$, $r^{n\ldots}$ and $r^{n\ldots m}$ which specify
|
|
|
495 |
intervals for how many times $r$ should match.
|
|
|
496 |
$r^{\ldots m}$ means repeating
|
|
|
497 |
at most $m$ times, $r^{n\ldots}$ means repeating at least $n$ times and
|
|
|
498 |
$r^{n\ldots m}$ means repeating between $n$ and $m$ times.
|
|
|
499 |
The results presented in this thesis extend straightforwardly to them
|
|
|
500 |
too.
|
|
602
|
501 |
Their formal definitions will be given later.
|
|
603
|
502 |
|
|
602
|
503 |
Bounded repetitions are important because they
|
|
603
|
504 |
tend to occur often in practical use, for example in RegExLib,
|
|
602
|
505 |
Snort, as well as in XML Schema definitions (XSDs).
|
|
603
|
506 |
According to Bj\"{o}rklund et al \cite{xml2015},
|
|
|
507 |
bounded regular expressions occur frequently in the latter and can have
|
|
|
508 |
counters up to ten million. An example XSD with a large counter they gave
|
|
|
509 |
was:
|
|
602
|
510 |
\begin{verbatim}
|
|
|
511 |
<sequence minOccurs="0" maxOccurs="65535">
|
|
|
512 |
<element name="TimeIncr" type="mpeg7:MediaIncrDurationType"/>
|
|
|
513 |
<element name="MotionParams" type="float" minOccurs="2" maxOccurs="12"/>
|
|
|
514 |
</sequence>
|
|
|
515 |
\end{verbatim}
|
|
603
|
516 |
This can be seen as the expression
|
|
602
|
517 |
$(ab^{2\ldots 12})^{0 \ldots 65535}$, where $a$ and $b$ are themselves
|
|
|
518 |
regular expressions
|
|
603
|
519 |
satisfying certain constraints (such as
|
|
|
520 |
satisfying the floating point number format).
|
|
|
521 |
The problem here is that tools based on the classic notion of
|
|
|
522 |
automata need to expand $r^{n}$ into $n$ connected
|
|
|
523 |
copies of the automaton for $r$. This leads to very inefficient matching
|
|
|
524 |
algorithms or algorithms that consume large amounts of memory.
|
|
|
525 |
A classic example is the regular expression $(a+b)^* a (a+b)^{n}$
|
|
|
526 |
where the minimal DFA requires at least $2^{n+1}$ states (more on this
|
|
|
527 |
later).
|
|
|
528 |
Therefore regular expressions matching libraries that rely on the classic
|
|
|
529 |
notion of DFAs often impose adhoc limits
|
|
|
530 |
for bounded regular expressions:
|
|
|
531 |
For example, in the regular expression matching library in the Go
|
|
|
532 |
language the regular expression $a^{1001}$ is not permitted, because no counter
|
|
|
533 |
can be above 1000, and in the built-in Rust regular expression library
|
|
|
534 |
expressions such as $a^{\{1000\}\{100\}\{5\}}$ give an error message
|
|
|
535 |
for being too big. These problems can of course be solved in matching algorithms where
|
|
|
536 |
automata go beyond the classic notion and for instance include explicit
|
|
|
537 |
counters \cite{Turo_ov__2020}.
|
|
|
538 |
The point here is that Brzozowski derivatives and the algorithms by Sulzmann and Lu can be
|
|
|
539 |
straightforwardly extended to deal with bounded regular expressions
|
|
|
540 |
and moreover the resulting code still consists of only simple
|
|
|
541 |
recursive functions and inductive datatypes.
|
|
|
542 |
Finally, bounded regular expressions do not destroy our finite
|
|
|
543 |
boundedness property, which we shall prove later on.
|
|
601
|
544 |
|
|
604
|
545 |
\section{Back-references and The Terminology Regex}
|
|
|
546 |
|
|
|
547 |
|
|
|
548 |
Bounded repetitions, usually written in the form
|
|
|
549 |
$r^{\{c\}}$ (where $c$ is a constant natural number),
|
|
|
550 |
denotes a regular expression accepting strings
|
|
|
551 |
that can be divided into $c$ substrings, where each
|
|
|
552 |
substring is in $r$.
|
|
|
553 |
For the regular expression $(a|b)^*a(a|b)^{\{2\}}$,
|
|
|
554 |
an $\mathit{NFA}$ describing it would look like:
|
|
|
555 |
\begin{center}
|
|
|
556 |
\begin{tikzpicture}[shorten >=1pt,node distance=2cm,on grid,auto]
|
|
|
557 |
\node[state,initial] (q_0) {$q_0$};
|
|
|
558 |
\node[state, red] (q_1) [right=of q_0] {$q_1$};
|
|
|
559 |
\node[state, red] (q_2) [right=of q_1] {$q_2$};
|
|
|
560 |
\node[state, accepting, red](q_3) [right=of q_2] {$q_3$};
|
|
|
561 |
\path[->]
|
|
|
562 |
(q_0) edge node {a} (q_1)
|
|
|
563 |
edge [loop below] node {a,b} ()
|
|
|
564 |
(q_1) edge node {a,b} (q_2)
|
|
|
565 |
(q_2) edge node {a,b} (q_3);
|
|
|
566 |
\end{tikzpicture}
|
|
|
567 |
\end{center}
|
|
|
568 |
The red states are "countdown states" which counts down
|
|
|
569 |
the number of characters needed in addition to the current
|
|
|
570 |
string to make a successful match.
|
|
|
571 |
For example, state $q_1$ indicates a match that has
|
|
|
572 |
gone past the $(a|b)^*$ part of $(a|b)^*a(a|b)^{\{2\}}$,
|
|
|
573 |
and just consumed the "delimiter" $a$ in the middle, and
|
|
|
574 |
need to match 2 more iterations of $(a|b)$ to complete.
|
|
|
575 |
State $q_2$ on the other hand, can be viewed as a state
|
|
|
576 |
after $q_1$ has consumed 1 character, and just waits
|
|
|
577 |
for 1 more character to complete.
|
|
|
578 |
$q_3$ is the last state, requiring 0 more character and is accepting.
|
|
|
579 |
Depending on the suffix of the
|
|
|
580 |
input string up to the current read location,
|
|
|
581 |
the states $q_1$ and $q_2$, $q_3$
|
|
|
582 |
may or may
|
|
|
583 |
not be active, independent from each other.
|
|
|
584 |
A $\mathit{DFA}$ for such an $\mathit{NFA}$ would
|
|
|
585 |
contain at least $2^3$ non-equivalent states that cannot be merged,
|
|
|
586 |
because the subset construction during determinisation will generate
|
|
|
587 |
all the elements in the power set $\mathit{Pow}\{q_1, q_2, q_3\}$.
|
|
|
588 |
Generalizing this to regular expressions with larger
|
|
|
589 |
bounded repetitions number, we have that
|
|
|
590 |
regexes shaped like $r^*ar^{\{n\}}$ when converted to $\mathit{DFA}$s
|
|
|
591 |
would require at least $2^{n+1}$ states, if $r$ contains
|
|
|
592 |
more than 1 string.
|
|
|
593 |
This is to represent all different
|
|
|
594 |
scenarios which "countdown" states are active.
|
|
|
595 |
For those regexes, tools that uses $\DFA$s will get
|
|
|
596 |
out of memory errors.
|
|
|
597 |
|
|
|
598 |
|
|
603
|
599 |
The time cost of regex matching algorithms in general
|
|
|
600 |
involve two different phases, and different things can go differently wrong on
|
|
|
601 |
these phases.
|
|
|
602 |
$\DFA$s usually have problems in the first (construction) phase
|
|
|
603 |
, whereas $\NFA$s usually run into trouble
|
|
|
604 |
on the second phase.
|
|
|
605 |
|
|
|
606 |
|
|
|
607 |
\section{Error-prone POSIX Implementations}
|
|
|
608 |
The problems with practical implementations
|
|
|
609 |
of reare not limited to slowness on certain
|
|
538
|
610 |
cases.
|
|
|
611 |
Another thing about these libraries is that there
|
|
|
612 |
is no correctness guarantee.
|
|
|
613 |
In some cases, they either fail to generate a lexing result when there exists a match,
|
|
|
614 |
or give results that are inconsistent with the $\POSIX$ standard.
|
|
601
|
615 |
A concrete example would be the regex
|
|
|
616 |
\begin{center}
|
|
|
617 |
$(aba + ab + a)* \text{and the string} ababa$
|
|
|
618 |
\end{center}
|
|
538
|
619 |
The correct $\POSIX$ match for the above would be
|
|
|
620 |
with the entire string $ababa$,
|
|
|
621 |
split into two Kleene star iterations, $[ab] [aba]$ at positions
|
|
|
622 |
$[0, 2), [2, 5)$
|
|
|
623 |
respectively.
|
|
|
624 |
But trying this out in regex101\parencite{regex101}
|
|
|
625 |
with different language engines would yield
|
|
|
626 |
the same two fragmented matches: $[aba]$ at $[0, 3)$
|
|
|
627 |
and $a$ at $[4, 5)$.
|
|
|
628 |
|
|
|
629 |
Kuklewicz\parencite{KuklewiczHaskell} commented that most regex libraries are not
|
|
|
630 |
correctly implementing the POSIX (maximum-munch)
|
|
|
631 |
rule of regular expression matching.
|
|
|
632 |
|
|
601
|
633 |
As Grathwohl\parencite{grathwohl2014crash} wrote,
|
|
|
634 |
\begin{quote}
|
|
|
635 |
The POSIX strategy is more complicated than the
|
|
|
636 |
greedy because of the dependence on information about
|
|
|
637 |
the length of matched strings in the various subexpressions.
|
|
|
638 |
\end{quote}
|
|
|
639 |
%\noindent
|
|
538
|
640 |
To summarise the above, regular expressions are important.
|
|
|
641 |
They are popular and programming languages' library functions
|
|
|
642 |
for them are very fast on non-catastrophic cases.
|
|
|
643 |
But there are problems with current practical implementations.
|
|
|
644 |
First thing is that the running time might blow up.
|
|
|
645 |
The second problem is that they might be error-prone on certain
|
|
543
|
646 |
very simple cases.
|
|
538
|
647 |
In the next part of the chapter, we will look into reasons why
|
|
|
648 |
certain regex engines are running horribly slow on the "catastrophic"
|
|
|
649 |
cases and propose a solution that addresses both of these problems
|
|
|
650 |
based on Brzozowski and Sulzmann and Lu's work.
|
|
|
651 |
|
|
|
652 |
|
|
|
653 |
|
|
|
654 |
\subsection{Different Phases of a Matching/Lexing Algorithm}
|
|
|
655 |
|
|
|
656 |
|
|
|
657 |
Most lexing algorithms can be roughly divided into
|
|
|
658 |
two phases during its run.
|
|
|
659 |
The first phase is the "construction" phase,
|
|
|
660 |
in which the algorithm builds some
|
|
|
661 |
suitable data structure from the input regex $r$, so that
|
|
|
662 |
it can be easily operated on later.
|
|
|
663 |
We denote
|
|
|
664 |
the time cost for such a phase by $P_1(r)$.
|
|
|
665 |
The second phase is the lexing phase, when the input string
|
|
|
666 |
$s$ is read and the data structure
|
|
|
667 |
representing that regex $r$ is being operated on.
|
|
|
668 |
We represent the time
|
|
532
|
669 |
it takes by $P_2(r, s)$.\\
|
|
538
|
670 |
For $\mathit{DFA}$,
|
|
532
|
671 |
we have $P_2(r, s) = O( |s| )$,
|
|
|
672 |
because we take at most $|s|$ steps,
|
|
|
673 |
and each step takes
|
|
|
674 |
at most one transition--
|
|
|
675 |
a deterministic-finite-automata
|
|
|
676 |
by definition has at most one state active and at most one
|
|
|
677 |
transition upon receiving an input symbol.
|
|
|
678 |
But unfortunately in the worst case
|
|
538
|
679 |
$P_1(r) = O(exp^{|r|})$. An example will be given later.
|
|
532
|
680 |
For $\mathit{NFA}$s, we have $P_1(r) = O(|r|)$ if we do not unfold
|
|
601
|
681 |
expressions like $r^n$ into
|
|
|
682 |
\[
|
|
|
683 |
\underbrace{r \cdots r}_{\text{n copies of r}}.
|
|
|
684 |
\]
|
|
532
|
685 |
The $P_2(r, s)$ is bounded by $|r|\cdot|s|$, if we do not backtrack.
|
|
|
686 |
On the other hand, if backtracking is used, the worst-case time bound bloats
|
|
601
|
687 |
to $|r| * 2^{|s|}$.
|
|
532
|
688 |
%on the input
|
|
|
689 |
%And when calculating the time complexity of the matching algorithm,
|
|
|
690 |
%we are assuming that each input reading step requires constant time.
|
|
|
691 |
%which translates to that the number of
|
|
|
692 |
%states active and transitions taken each time is bounded by a
|
|
|
693 |
%constant $C$.
|
|
|
694 |
%But modern regex libraries in popular language engines
|
|
|
695 |
% often want to support much richer constructs than just
|
|
|
696 |
% sequences and Kleene stars,
|
|
|
697 |
%such as negation, intersection,
|
|
|
698 |
%bounded repetitions and back-references.
|
|
|
699 |
%And de-sugaring these "extended" regular expressions
|
|
|
700 |
%into basic ones might bloat the size exponentially.
|
|
|
701 |
%TODO: more reference for exponential size blowup on desugaring.
|
|
538
|
702 |
|
|
|
703 |
\subsection{Why $\mathit{DFA}s$ can be slow in the first phase}
|
|
|
704 |
|
|
|
705 |
|
|
532
|
706 |
The good things about $\mathit{DFA}$s is that once
|
|
|
707 |
generated, they are fast and stable, unlike
|
|
|
708 |
backtracking algorithms.
|
|
538
|
709 |
However, they do not scale well with bounded repetitions.
|
|
532
|
710 |
|
|
538
|
711 |
\subsubsection{Problems with Bounded Repetitions}
|
|
604
|
712 |
|
|
|
713 |
|
|
|
714 |
|
|
|
715 |
|
|
538
|
716 |
|
|
|
717 |
\subsubsection{Tools that uses $\mathit{DFA}$s}
|
|
|
718 |
%TODO:more tools that use DFAs?
|
|
|
719 |
$\mathit{LEX}$ and $\mathit{JFLEX}$ are tools
|
|
|
720 |
in $C$ and $\mathit{JAVA}$ that generates $\mathit{DFA}$-based
|
|
|
721 |
lexers. The user provides a set of regular expressions
|
|
|
722 |
and configurations to such lexer generators, and then
|
|
|
723 |
gets an output program encoding a minimized $\mathit{DFA}$
|
|
|
724 |
that can be compiled and run.
|
|
|
725 |
When given the above countdown regular expression,
|
|
|
726 |
a small number $n$ would result in a determinised automata
|
|
|
727 |
with millions of states.
|
|
|
728 |
|
|
532
|
729 |
For this reason, regex libraries that support
|
|
|
730 |
bounded repetitions often choose to use the $\mathit{NFA}$
|
|
|
731 |
approach.
|
|
538
|
732 |
|
|
|
733 |
|
|
|
734 |
|
|
|
735 |
|
|
|
736 |
|
|
|
737 |
|
|
|
738 |
|
|
|
739 |
|
|
|
740 |
\subsection{Why $\mathit{NFA}$s can be slow in the second phase}
|
|
|
741 |
When one constructs an $\NFA$ out of a regular expression
|
|
|
742 |
there is often very little to be done in the first phase, one simply
|
|
|
743 |
construct the $\NFA$ states based on the structure of the input regular expression.
|
|
|
744 |
|
|
|
745 |
In the lexing phase, one can simulate the $\mathit{NFA}$ running in two ways:
|
|
532
|
746 |
one by keeping track of all active states after consuming
|
|
|
747 |
a character, and update that set of states iteratively.
|
|
|
748 |
This can be viewed as a breadth-first-search of the $\mathit{NFA}$
|
|
|
749 |
for a path terminating
|
|
|
750 |
at an accepting state.
|
|
|
751 |
Languages like $\mathit{Go}$ and $\mathit{Rust}$ use this
|
|
538
|
752 |
type of $\mathit{NFA}$ simulation and guarantees a linear runtime
|
|
532
|
753 |
in terms of input string length.
|
|
|
754 |
%TODO:try out these lexers
|
|
|
755 |
The other way to use $\mathit{NFA}$ for matching is choosing
|
|
|
756 |
a single transition each time, keeping all the other options in
|
|
|
757 |
a queue or stack, and backtracking if that choice eventually
|
|
|
758 |
fails. This method, often called a "depth-first-search",
|
|
|
759 |
is efficient in a lot of cases, but could end up
|
|
|
760 |
with exponential run time.\\
|
|
|
761 |
%TODO:COMPARE java python lexer speed with Rust and Go
|
|
|
762 |
The reason behind backtracking algorithms in languages like
|
|
|
763 |
Java and Python is that they support back-references.
|
|
538
|
764 |
\subsubsection{Back References}
|
|
532
|
765 |
If we have a regular expression like this (the sequence
|
|
|
766 |
operator is omitted for brevity):
|
|
|
767 |
\begin{center}
|
|
|
768 |
$r_1(r_2(r_3r_4))$
|
|
|
769 |
\end{center}
|
|
|
770 |
We could label sub-expressions of interest
|
|
|
771 |
by parenthesizing them and giving
|
|
|
772 |
them a number by the order in which their opening parentheses appear.
|
|
|
773 |
One possible way of parenthesizing and labelling is given below:
|
|
|
774 |
\begin{center}
|
|
|
775 |
$\underset{1}{(}r_1\underset{2}{(}r_2\underset{3}{(}r_3)\underset{4}{(}r_4)))$
|
|
|
776 |
\end{center}
|
|
|
777 |
$r_1r_2r_3r_4$, $r_1r_2r_3$, $r_3$, $r_4$ are labelled
|
|
|
778 |
by 1 to 4. $1$ would refer to the entire expression
|
|
|
779 |
$(r_1(r_2(r_3)(r_4)))$, $2$ referring to $r_2(r_3)(r_4)$, etc.
|
|
|
780 |
These sub-expressions are called "capturing groups".
|
|
|
781 |
We can use the following syntax to denote that we want a string just matched by a
|
|
|
782 |
sub-expression (capturing group) to appear at a certain location again,
|
|
|
783 |
exactly as it was:
|
|
|
784 |
\begin{center}
|
|
|
785 |
$\ldots\underset{\text{i-th lparen}}{(}{r_i})\ldots
|
|
|
786 |
\underset{s_i \text{ which just matched} \;r_i}{\backslash i}$
|
|
|
787 |
\end{center}
|
|
|
788 |
The backslash and number $i$ are used to denote such
|
|
|
789 |
so-called "back-references".
|
|
|
790 |
Let $e$ be an expression made of regular expressions
|
|
|
791 |
and back-references. $e$ contains the expression $e_i$
|
|
|
792 |
as its $i$-th capturing group.
|
|
|
793 |
The semantics of back-reference can be recursively
|
|
|
794 |
written as:
|
|
|
795 |
\begin{center}
|
|
|
796 |
\begin{tabular}{c}
|
|
|
797 |
$L ( e \cdot \backslash i) = \{s @ s_i \mid s \in L (e)\quad s_i \in L(r_i)$\\
|
|
|
798 |
$s_i\; \text{match of ($e$, $s$)'s $i$-th capturing group string}\}$
|
|
|
799 |
\end{tabular}
|
|
|
800 |
\end{center}
|
|
|
801 |
The concrete example
|
|
|
802 |
$((a|b|c|\ldots|z)^*)\backslash 1$
|
|
|
803 |
would match the string like $\mathit{bobo}$, $\mathit{weewee}$ and etc.\\
|
|
|
804 |
Back-reference is a construct in the "regex" standard
|
|
|
805 |
that programmers found useful, but not exactly
|
|
|
806 |
regular any more.
|
|
|
807 |
In fact, that allows the regex construct to express
|
|
|
808 |
languages that cannot be contained in context-free
|
|
|
809 |
languages either.
|
|
|
810 |
For example, the back-reference $((a^*)b\backslash1 b \backslash 1$
|
|
|
811 |
expresses the language $\{a^n b a^n b a^n\mid n \in \mathbb{N}\}$,
|
|
|
812 |
which cannot be expressed by context-free grammars\parencite{campeanu2003formal}.
|
|
|
813 |
Such a language is contained in the context-sensitive hierarchy
|
|
|
814 |
of formal languages.
|
|
|
815 |
Solving the back-reference expressions matching problem
|
|
|
816 |
is NP-complete\parencite{alfred2014algorithms} and a non-bactracking,
|
|
|
817 |
efficient solution is not known to exist.
|
|
|
818 |
%TODO:read a bit more about back reference algorithms
|
|
538
|
819 |
|
|
532
|
820 |
It seems that languages like Java and Python made the trade-off
|
|
|
821 |
to support back-references at the expense of having to backtrack,
|
|
|
822 |
even in the case of regexes not involving back-references.\\
|
|
|
823 |
Summing these up, we can categorise existing
|
|
|
824 |
practical regex libraries into the ones with linear
|
|
|
825 |
time guarantees like Go and Rust, which impose restrictions
|
|
|
826 |
on the user input (not allowing back-references,
|
|
538
|
827 |
bounded repetitions cannot exceed 1000 etc.), and ones
|
|
532
|
828 |
that allows the programmer much freedom, but grinds to a halt
|
|
|
829 |
in some non-negligible portion of cases.
|
|
|
830 |
%TODO: give examples such as RE2 GOLANG 1000 restriction, rust no repetitions
|
|
|
831 |
% For example, the Rust regex engine claims to be linear,
|
|
|
832 |
% but does not support lookarounds and back-references.
|
|
|
833 |
% The GoLang regex library does not support over 1000 repetitions.
|
|
|
834 |
% Java and Python both support back-references, but shows
|
|
|
835 |
%catastrophic backtracking behaviours on inputs without back-references(
|
|
|
836 |
%when the language is still regular).
|
|
|
837 |
%TODO: test performance of Rust on (((((a*a*)b*)b){20})*)c baabaabababaabaaaaaaaaababaaaababababaaaabaaabaaaaaabaabaabababaababaaaaaaaaababaaaababababaaaaaaaaaaaaac
|
|
|
838 |
%TODO: verify the fact Rust does not allow 1000+ reps
|
|
|
839 |
|
|
|
840 |
|
|
538
|
841 |
So we have practical implementations
|
|
|
842 |
on regular expression matching/lexing which are fast
|
|
|
843 |
but do not come with any guarantees that it will not grind to a halt
|
|
|
844 |
or give wrong answers.
|
|
|
845 |
Our goal is to have a regex lexing algorithm that comes with
|
|
|
846 |
\begin{itemize}
|
|
|
847 |
\item
|
|
|
848 |
proven correctness
|
|
|
849 |
\item
|
|
|
850 |
proven non-catastrophic properties
|
|
|
851 |
\item
|
|
|
852 |
easy extensions to
|
|
|
853 |
constructs like
|
|
|
854 |
bounded repetitions, negation, lookarounds, and even back-references.
|
|
|
855 |
\end{itemize}
|
|
532
|
856 |
|
|
538
|
857 |
\section{Our Solution--Formal Specification of POSIX and Brzozowski Derivatives}
|
|
|
858 |
We propose Brzozowski derivatives on regular expressions as
|
|
|
859 |
a solution to this.
|
|
|
860 |
In the last fifteen or so years, Brzozowski's derivatives of regular
|
|
|
861 |
expressions have sparked quite a bit of interest in the functional
|
|
|
862 |
programming and theorem prover communities.
|
|
532
|
863 |
|
|
538
|
864 |
\subsection{Motivation}
|
|
|
865 |
|
|
|
866 |
Derivatives give a simple solution
|
|
|
867 |
to the problem of matching a string $s$ with a regular
|
|
|
868 |
expression $r$: if the derivative of $r$ w.r.t.\ (in
|
|
|
869 |
succession) all the characters of the string matches the empty string,
|
|
|
870 |
then $r$ matches $s$ (and {\em vice versa}).
|
|
532
|
871 |
|
|
538
|
872 |
The beauty of
|
|
532
|
873 |
Brzozowski's derivatives \parencite{Brzozowski1964} is that they are neatly
|
|
|
874 |
expressible in any functional language, and easily definable and
|
|
|
875 |
reasoned about in theorem provers---the definitions just consist of
|
|
|
876 |
inductive datatypes and simple recursive functions.
|
|
|
877 |
And an algorithms based on it by
|
|
|
878 |
Suzmann and Lu \parencite{Sulzmann2014} allows easy extension
|
|
|
879 |
to include extended regular expressions and
|
|
|
880 |
simplification of internal data structures
|
|
|
881 |
eliminating the exponential behaviours.
|
|
|
882 |
|
|
|
883 |
However, two difficulties with derivative-based matchers exist:
|
|
538
|
884 |
\subsubsection{Problems with Current Brzozowski Matchers}
|
|
532
|
885 |
First, Brzozowski's original matcher only generates a yes/no answer
|
|
|
886 |
for whether a regular expression matches a string or not. This is too
|
|
|
887 |
little information in the context of lexing where separate tokens must
|
|
|
888 |
be identified and also classified (for example as keywords
|
|
|
889 |
or identifiers). Sulzmann and Lu~\cite{Sulzmann2014} overcome this
|
|
|
890 |
difficulty by cleverly extending Brzozowski's matching
|
|
|
891 |
algorithm. Their extended version generates additional information on
|
|
|
892 |
\emph{how} a regular expression matches a string following the POSIX
|
|
|
893 |
rules for regular expression matching. They achieve this by adding a
|
|
|
894 |
second ``phase'' to Brzozowski's algorithm involving an injection
|
|
538
|
895 |
function. In our own earlier work, we provided the formal
|
|
532
|
896 |
specification of what POSIX matching means and proved in Isabelle/HOL
|
|
|
897 |
the correctness
|
|
|
898 |
of Sulzmann and Lu's extended algorithm accordingly
|
|
|
899 |
\cite{AusafDyckhoffUrban2016}.
|
|
|
900 |
|
|
|
901 |
The second difficulty is that Brzozowski's derivatives can
|
|
|
902 |
grow to arbitrarily big sizes. For example if we start with the
|
|
|
903 |
regular expression $(a+aa)^*$ and take
|
|
|
904 |
successive derivatives according to the character $a$, we end up with
|
|
|
905 |
a sequence of ever-growing derivatives like
|
|
|
906 |
|
|
|
907 |
\def\ll{\stackrel{\_\backslash{} a}{\longrightarrow}}
|
|
|
908 |
\begin{center}
|
|
|
909 |
\begin{tabular}{rll}
|
|
|
910 |
$(a + aa)^*$ & $\ll$ & $(\ONE + \ONE{}a) \cdot (a + aa)^*$\\
|
|
|
911 |
& $\ll$ & $(\ZERO + \ZERO{}a + \ONE) \cdot (a + aa)^* \;+\; (\ONE + \ONE{}a) \cdot (a + aa)^*$\\
|
|
|
912 |
& $\ll$ & $(\ZERO + \ZERO{}a + \ZERO) \cdot (a + aa)^* + (\ONE + \ONE{}a) \cdot (a + aa)^* \;+\; $\\
|
|
|
913 |
& & $\qquad(\ZERO + \ZERO{}a + \ONE) \cdot (a + aa)^* + (\ONE + \ONE{}a) \cdot (a + aa)^*$\\
|
|
|
914 |
& $\ll$ & \ldots \hspace{15mm}(regular expressions of sizes 98, 169, 283, 468, 767, \ldots)
|
|
|
915 |
\end{tabular}
|
|
|
916 |
\end{center}
|
|
|
917 |
|
|
|
918 |
\noindent where after around 35 steps we run out of memory on a
|
|
|
919 |
typical computer (we shall define shortly the precise details of our
|
|
|
920 |
regular expressions and the derivative operation). Clearly, the
|
|
|
921 |
notation involving $\ZERO$s and $\ONE$s already suggests
|
|
|
922 |
simplification rules that can be applied to regular regular
|
|
|
923 |
expressions, for example $\ZERO{}\,r \Rightarrow \ZERO$, $\ONE{}\,r
|
|
|
924 |
\Rightarrow r$, $\ZERO{} + r \Rightarrow r$ and $r + r \Rightarrow
|
|
|
925 |
r$. While such simple-minded simplifications have been proved in our
|
|
|
926 |
earlier work to preserve the correctness of Sulzmann and Lu's
|
|
|
927 |
algorithm \cite{AusafDyckhoffUrban2016}, they unfortunately do
|
|
|
928 |
\emph{not} help with limiting the growth of the derivatives shown
|
|
|
929 |
above: the growth is slowed, but the derivatives can still grow rather
|
|
|
930 |
quickly beyond any finite bound.
|
|
|
931 |
|
|
|
932 |
|
|
|
933 |
Sulzmann and Lu overcome this ``growth problem'' in a second algorithm
|
|
538
|
934 |
\cite{Sulzmann2014} where they introduce bit-coded
|
|
532
|
935 |
regular expressions. In this version, POSIX values are
|
|
538
|
936 |
represented as bit sequences and such sequences are incrementally generated
|
|
532
|
937 |
when derivatives are calculated. The compact representation
|
|
538
|
938 |
of bit sequences and regular expressions allows them to define a more
|
|
532
|
939 |
``aggressive'' simplification method that keeps the size of the
|
|
|
940 |
derivatives finite no matter what the length of the string is.
|
|
|
941 |
They make some informal claims about the correctness and linear behaviour
|
|
|
942 |
of this version, but do not provide any supporting proof arguments, not
|
|
538
|
943 |
even ``pencil-and-paper'' arguments. They write about their bit-coded
|
|
532
|
944 |
\emph{incremental parsing method} (that is the algorithm to be formalised
|
|
538
|
945 |
in this dissertation)
|
|
532
|
946 |
|
|
|
947 |
|
|
|
948 |
|
|
|
949 |
\begin{quote}\it
|
|
|
950 |
``Correctness Claim: We further claim that the incremental parsing
|
|
|
951 |
method [..] in combination with the simplification steps [..]
|
|
|
952 |
yields POSIX parse trees. We have tested this claim
|
|
|
953 |
extensively [..] but yet
|
|
|
954 |
have to work out all proof details.'' \cite[Page 14]{Sulzmann2014}
|
|
|
955 |
\end{quote}
|
|
|
956 |
|
|
|
957 |
Ausaf and Urban were able to back this correctness claim with
|
|
|
958 |
a formal proof.
|
|
|
959 |
|
|
|
960 |
But as they stated,
|
|
|
961 |
\begin{quote}\it
|
|
|
962 |
The next step would be to implement a more aggressive simplification procedure on annotated regular expressions and then prove the corresponding algorithm generates the same values as blexer. Alas due to time constraints we are unable to do so here.
|
|
|
963 |
\end{quote}
|
|
|
964 |
|
|
|
965 |
This thesis implements the aggressive simplifications envisioned
|
|
|
966 |
by Ausaf and Urban,
|
|
|
967 |
and gives a formal proof of the correctness with those simplifications.
|
|
|
968 |
|
|
|
969 |
|
|
|
970 |
%----------------------------------------------------------------------------------------
|
|
|
971 |
\section{Contribution}
|
|
|
972 |
|
|
|
973 |
|
|
|
974 |
|
|
|
975 |
This work addresses the vulnerability of super-linear and
|
|
|
976 |
buggy regex implementations by the combination
|
|
|
977 |
of Brzozowski's derivatives and interactive theorem proving.
|
|
|
978 |
We give an
|
|
|
979 |
improved version of Sulzmann and Lu's bit-coded algorithm using
|
|
|
980 |
derivatives, which come with a formal guarantee in terms of correctness and
|
|
|
981 |
running time as an Isabelle/HOL proof.
|
|
538
|
982 |
Further improvements to the algorithm with an even stronger version of
|
|
|
983 |
simplification is made.
|
|
|
984 |
We have not yet come up with one, but believe that it leads to a
|
|
|
985 |
formalised proof with a time bound linear to input and
|
|
532
|
986 |
cubic to regular expression size using a technique by
|
|
538
|
987 |
Antimirov\cite{Antimirov}.
|
|
532
|
988 |
|
|
|
989 |
|
|
538
|
990 |
The main contribution of this thesis is
|
|
|
991 |
\begin{itemize}
|
|
|
992 |
\item
|
|
|
993 |
a proven correct lexing algorithm
|
|
|
994 |
\item
|
|
|
995 |
with formalized finite bounds on internal data structures' sizes.
|
|
|
996 |
\end{itemize}
|
|
|
997 |
|
|
532
|
998 |
To our best knowledge, no lexing libraries using Brzozowski derivatives
|
|
|
999 |
have a provable time guarantee,
|
|
|
1000 |
and claims about running time are usually speculative and backed by thin empirical
|
|
|
1001 |
evidence.
|
|
|
1002 |
%TODO: give references
|
|
|
1003 |
For example, Sulzmann and Lu had proposed an algorithm in which they
|
|
|
1004 |
claim a linear running time.
|
|
|
1005 |
But that was falsified by our experiments and the running time
|
|
|
1006 |
is actually $\Omega(2^n)$ in the worst case.
|
|
|
1007 |
A similar claim about a theoretical runtime of $O(n^2)$ is made for the Verbatim
|
|
|
1008 |
%TODO: give references
|
|
|
1009 |
lexer, which calculates POSIX matches and is based on derivatives.
|
|
|
1010 |
They formalized the correctness of the lexer, but not the complexity.
|
|
|
1011 |
In the performance evaluation section, they simply analyzed the run time
|
|
|
1012 |
of matching $a$ with the string $\underbrace{a \ldots a}_{\text{n a's}}$
|
|
|
1013 |
and concluded that the algorithm is quadratic in terms of input length.
|
|
|
1014 |
When we tried out their extracted OCaml code with our example $(a+aa)^*$,
|
|
|
1015 |
the time it took to lex only 40 $a$'s was 5 minutes.
|
|
|
1016 |
|
|
|
1017 |
|
|
|
1018 |
|
|
|
1019 |
\subsection{Related Work}
|
|
|
1020 |
We are aware
|
|
|
1021 |
of a mechanised correctness proof of Brzozowski's derivative-based matcher in HOL4 by
|
|
|
1022 |
Owens and Slind~\parencite{Owens2008}. Another one in Isabelle/HOL is part
|
|
|
1023 |
of the work by Krauss and Nipkow \parencite{Krauss2011}. And another one
|
|
|
1024 |
in Coq is given by Coquand and Siles \parencite{Coquand2012}.
|
|
|
1025 |
Also Ribeiro and Du Bois give one in Agda \parencite{RibeiroAgda2017}.
|
|
|
1026 |
|
|
538
|
1027 |
|
|
|
1028 |
When a regular expression does not behave as intended,
|
|
|
1029 |
people usually try to rewrite the regex to some equivalent form
|
|
|
1030 |
or they try to avoid the possibly problematic patterns completely,
|
|
|
1031 |
for which many false positives exist\parencite{Davis18}.
|
|
|
1032 |
Animated tools to "debug" regular expressions such as
|
|
|
1033 |
\parencite{regexploit2021} \parencite{regex101} are also popular.
|
|
|
1034 |
We are also aware of static analysis work on regular expressions that
|
|
|
1035 |
aims to detect potentially expoential regex patterns. Rathnayake and Thielecke
|
|
|
1036 |
\parencite{Rathnayake2014StaticAF} proposed an algorithm
|
|
|
1037 |
that detects regular expressions triggering exponential
|
|
|
1038 |
behavious on backtracking matchers.
|
|
|
1039 |
Weideman \parencite{Weideman2017Static} came up with
|
|
|
1040 |
non-linear polynomial worst-time estimates
|
|
|
1041 |
for regexes, attack string that exploit the worst-time
|
|
|
1042 |
scenario, and "attack automata" that generates
|
|
|
1043 |
attack strings.
|
|
|
1044 |
|
|
|
1045 |
|
|
532
|
1046 |
|
|
|
1047 |
|
|
|
1048 |
\section{Structure of the thesis}
|
|
538
|
1049 |
In chapter 2 \ref{Inj} we will introduce the concepts
|
|
532
|
1050 |
and notations we
|
|
|
1051 |
use for describing the lexing algorithm by Sulzmann and Lu,
|
|
538
|
1052 |
and then give the lexing algorithm.
|
|
|
1053 |
We will give its variant in \ref{Bitcoded1}.
|
|
|
1054 |
Then we illustrate in \ref{Bitcoded2}
|
|
532
|
1055 |
how the algorithm without bitcodes falls short for such aggressive
|
|
|
1056 |
simplifications and therefore introduce our version of the
|
|
538
|
1057 |
bit-coded algorithm and
|
|
532
|
1058 |
its correctness proof .
|
|
538
|
1059 |
In \ref{Finite} we give the second guarantee
|
|
532
|
1060 |
of our bitcoded algorithm, that is a finite bound on the size of any
|
|
|
1061 |
regex's derivatives.
|
|
538
|
1062 |
In \ref{Cubic} we discuss stronger simplifications to improve the finite bound
|
|
|
1063 |
in \ref{Finite} to a polynomial one, and demonstrate how one can extend the
|
|
532
|
1064 |
algorithm to include constructs such as bounded repetitions and negations.
|
|
|
1065 |
|
|
|
1066 |
|
|
|
1067 |
|
|
|
1068 |
|
|
|
1069 |
|
|
|
1070 |
%----------------------------------------------------------------------------------------
|
|
|
1071 |
|
|
|
1072 |
|
|
|
1073 |
%----------------------------------------------------------------------------------------
|
|
|
1074 |
|
|
|
1075 |
%----------------------------------------------------------------------------------------
|
|
|
1076 |
|
|
|
1077 |
%----------------------------------------------------------------------------------------
|
|
|
1078 |
|
|
|
1079 |
|