66 For example, if you use in <A HREF="http://www.python.org">Python</A> or |
66 For example, if you use in <A HREF="http://www.python.org">Python</A> or |
67 in <A HREF="http://www.ruby-lang.org/en/">Ruby</A> (probably also in other mainstream programming languages) the |
67 in <A HREF="http://www.ruby-lang.org/en/">Ruby</A> (probably also in other mainstream programming languages) the |
68 innocently looking regular expression <code>a?{28}a{28}</code> and match it, say, against the string |
68 innocently looking regular expression <code>a?{28}a{28}</code> and match it, say, against the string |
69 <code>aaaaaaaaaaaaaaaaaaaaaaaaaaaa</code> (that is 28 <code>a</code>s), you will soon notice that your CPU usage goes to 100%. In fact, |
69 <code>aaaaaaaaaaaaaaaaaaaaaaaaaaaa</code> (that is 28 <code>a</code>s), you will soon notice that your CPU usage goes to 100%. In fact, |
70 Python and Ruby need approximately 30 seconds of hard work for matching this string. You can try it for yourself: |
70 Python and Ruby need approximately 30 seconds of hard work for matching this string. You can try it for yourself: |
71 <A HREF="http://www.dcs.kcl.ac.uk/staff/urbanc/cgi-bin/repos.cgi/afl-material/raw-file/tip/re.py">re.py</A> (Python version) and |
71 <A HREF="http://www.dcs.kcl.ac.uk/staff/urbanc/cgi-bin/repos.cgi/afl-material/raw-file/tip/progs/re.py">re.py</A> (Python version) and |
72 <A HREF="http://www.dcs.kcl.ac.uk/staff/urbanc/cgi-bin/repos.cgi/afl-material/raw-file/tip/re-internal.rb">re.rb</A> |
72 <A HREF="http://www.dcs.kcl.ac.uk/staff/urbanc/cgi-bin/repos.cgi/afl-material/raw-file/tip/progs/re-internal.rb">re.rb</A> |
73 (Ruby version). You can imagine an attacker |
73 (Ruby version). You can imagine an attacker |
74 mounting a nice <A HREF="http://en.wikipedia.org/wiki/Denial-of-service_attack">DoS attack</A> against |
74 mounting a nice <A HREF="http://en.wikipedia.org/wiki/Denial-of-service_attack">DoS attack</A> against |
75 your program if it contains such an “evil” regular expression. Actually |
75 your program if it contains such an “evil” regular expression. Actually |
76 <A HREF="http://www.scala-lang.org/">Scala</A> (and also Java) are almost immune from such |
76 <A HREF="http://www.scala-lang.org/">Scala</A> (and also Java) are almost immune from such |
77 attacks as they can deal with strings of up to 4,300 <code>a</code>s in less than a second. But if you scale |
77 attacks as they can deal with strings of up to 4,300 <code>a</code>s in less than a second. But if you scale |