Your Regex Engine Can Be a Security Hole. GitLab’s CVSS 10 Bug Shows How

A bad regex can freeze your server. A regex built from user input can do worse. Here is what GitLab's critical flaws teach every developer, with a small test you can repeat yourself.

Most of us treat a regular expression as a small helper. You write a pattern, it matches some text, and you move on.

But a regex is a tiny program, and some engines are complicated programs too. This month, GitLab shipped patches for critical flaws that all trace back to the regex engine inside Ruby. Understanding them takes about five minutes, and it changes how you handle patterns.

There are two different ways a regex goes wrong. Let's take them one at a time.

Danger One: The Regex That Takes Forever

The first is the famous one. Some patterns make the engine try a huge number of paths before giving up. This is called catastrophic backtracking.

Here is a classic bad pattern, (a+)+$, tested against a string of the letter "a" followed by one !. The test was run in Python and timed, with the harmless pattern a+$ as a comparison. The exact numbers will differ on your…