RE2-unsafe regex patterns: audit production segments and decide fallback policy

Open
#3 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
45/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Quiet
Tech stack
python, sql

Research direction

Start with _RE2_UNSAFE in src/flagsmith_sql_flag_engine/translator.py and inspect the engine-test-data suite. Run the proposed REGEXP_LIKE audit against the segments table’s rules JSON column to measure usage of backreferences and lookarounds. Done means the prevalence is recorded, a fallback policy is chosen, and the corresponding behavior is implemented and validated.

Written by the indexing model from the issue text.

Description

The translator returns None for any REGEX condition whose pattern contains:

  • Backreferences (\1\9)
  • Lookarounds ((?=, (?!, (?<=, (?<!)

Snowflake uses RE2, which doesn't support either feature. The detection is conservative-syntactic in _RE2_UNSAFE (src/flagsmith_sql_flag_engine/translator.py).

The engine-test-data suite doesn't include any RE2-unsafe patterns, currently.

What to do

  1. Audit production segment definitions for either pattern — REGEXP_LIKE over the segments table's rules JSON column with a pattern that catches \1\9 or (?=/(?!/(?<=/(?<! as substrings. Cheap query, gives a real prevalence number.
  2. Decide fallback policy based on prevalence:
    • If essentially nobody uses these features (most likely): surface the error at segment-edit time. The Flagsmith UI rejects the pattern with a clear "Snowflake-backed envs do not support backreferences / lookarounds" message. Translator's None return becomes an unreachable defensive branch.
    • If non-trivial usage: ship a fallback that runs the pattern through the Python flag_engine just for those segments, e.g. by calling out to an is_in_segment UDF. Adds back the per-row Python tax but only for the affected segments.
Dominant language
Python
Stars
1
Forks
0
PR merge metrics
No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from Flagsmith/flagsmith-sql-flag-engine

All issues in Flagsmith/flagsmith-sql-flag-engine

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.