61 and can "stab you in the back" according to |
61 and can "stab you in the back" according to |
62 this recent <A HREF="http://tech.blog.cueup.com/regular-expressions-will-stab-you-in-the-back">blog post</A>. |
62 this recent <A HREF="http://tech.blog.cueup.com/regular-expressions-will-stab-you-in-the-back">blog post</A>. |
63 For example, if you use in <A HREF="http://www.python.org">Python</A> or |
63 For example, if you use in <A HREF="http://www.python.org">Python</A> or |
64 in <A HREF="http://www.ruby-lang.org/en/">Ruby</A> (probably also in other mainstream programming languages) the |
64 in <A HREF="http://www.ruby-lang.org/en/">Ruby</A> (probably also in other mainstream programming languages) the |
65 innocently looking regular expression <code>a?{28}a{28}</code> and match it, say, against the string |
65 innocently looking regular expression <code>a?{28}a{28}</code> and match it, say, against the string |
66 <code>aaaaaaaaaaaaaaaaaaaaaaaaaaaa</code>, you will soon notice that your CPU usage goes to 100%. In fact, |
66 <code>aaaaaaaaaaaaaaaaaaaaaaaaaaaa</code> (that is 28 <code>a</code>s), you will soon notice that your CPU usage goes to 100%. In fact, |
67 Python and Ruby need approximately 30 seconds for matching this string. You can try it for yourself: |
67 Python and Ruby need approximately 30 seconds for matching this string. You can try it for yourself: |
68 <A HREF="http://www.dcs.kcl.ac.uk/staff/urbanc/cgi-bin/repos.cgi/afl-material/raw-file/tip/re.py">re.py</A> (Python version) and |
68 <A HREF="http://www.dcs.kcl.ac.uk/staff/urbanc/cgi-bin/repos.cgi/afl-material/raw-file/tip/re.py">re.py</A> (Python version) and |
69 <A HREF="http://www.dcs.kcl.ac.uk/staff/urbanc/cgi-bin/repos.cgi/afl-material/raw-file/tip/re-internal.rb">re.rb</A> |
69 <A HREF="http://www.dcs.kcl.ac.uk/staff/urbanc/cgi-bin/repos.cgi/afl-material/raw-file/tip/re-internal.rb">re.rb</A> |
70 (Ruby version). You can imagine an attacker |
70 (Ruby version). You can imagine an attacker |
71 mounting a nice <A HREF="http://en.wikipedia.org/wiki/Denial-of-service_attack">DoS attack</A> against |
71 mounting a nice <A HREF="http://en.wikipedia.org/wiki/Denial-of-service_attack">DoS attack</A> against |