Heads up: max_program_size deprecation will require re2j changes to allow validation

Open
#138 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
25/100
Issue type
Documentation
Clarity
Needs clarification
Activity status
Stale
Tech stack
java
Domain
backend

Research direction

The issue points to re2j's Pattern and Prog.inst, while noting that this repository may not explicitly manage GoogleRE2. First check whether java-control-plane has a validation entry point for regex program size; done would require confirming whether implementation is needed and scoping any relevant re2j change.

Written by the indexing model from the issue text.

Description

enhancement

This is just documenting the information that may be necessary if java-control-plane wants to start validating regular expression max_program_sizes. This is unnecessary if the regular expressions are considered "trusted" (known to be non-malicious).

I had this information and wanted to dump it somewhere that it may be useful if the need arises. It seems there is no explicit management of GoogleRE2 in this repo. Feel free to close.


In https://github.com/envoyproxy/envoy/pull/10971, Envoy deprecated the max_program_size configuration field in favor of the control plane being responsible. This is great, and works for C++ and Go languages, but leaves some TODOs for Java.

The C++ re2 exposes RE2::ProgramSize() which reports the number of instructions of the compiled regular expression. This is the "program size" that Envoy was referring to.

Go's regexp/syntax package allows getting something similar:

regex, err := syntax.Parse("INPUT HERE", 0)
prog, err := syntax.Compile(regex)
len(prog.Inst) // this is the program size

But it does not appear re2j supports such a feature. Basically, you will need a new Pattern method that returns the length of Prog.inst (via re2.prog).

Dominant language
Java
Stars
312
Forks
150
PR merge metrics
No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from envoyproxy/java-control-plane

All issues in envoyproxy/java-control-plane

Similar issues

More Java issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.