[ruby-core:113848] [Ruby master Feature#19694] Add Regexp#timeout= setter

Issue #19694 has been updated by Eregon (Benoit Daloze).





janosch-x (Janosch M=FCller) wrote in #note-9:

> A custom `timeout` only being available on `Regexp::new` might lead peopl=
e to write less performant code.



I think it is very well known and easy to know though profiling that one sh=
ould always cache the result of `Regexp.new` (e.g., in a constant).

The docs should point this out though.



> I'm not sure this is a strong argument. The big Regexps that take a notew=
orthy time to compile are often those with interpolation, as seen in the OP=
, and I assume these aren't so easy to pre-compile or deduplicate anyway.



Actually TruffleRuby inline-caches interpolated Regexp creation, so if it's=
 the same pattern then the same Regexp is used.

In the OP's case it seems easy to store the Regexp in a constant.



> Maybe there could be an instance method, `Regexp#with_timeout`, that crea=
tes *and memoizes* a copy with a specific timeout? This also sounds a bit h=
acky, though...



I think timeouts are inefficient and insufficient to address ReDoS. IMO the=
 real solution is #19720.



----------------------------------------

Feature #19694: Add Regexp#timeout=3D setter

https://bugs.ruby-lang.org/issues/19694#change-103497



* Author: aharpole (Aaron Harpole)

* Status: Open

* Priority: Normal

----------------------------------------

# Abstract



In addition to allowing for a Regexp timeout to be set on individual instan=
ces by setting a `timeout` argument in `Regexp.new`, I'm proposing that we =
also allow setting the timeout on Regexp objects with a `#timeout=3D` sette=
r.



# Background



To be able to roll out a global Regexp timeout for a large application, the=
re are inevitably some individual regexes for which a different timeout is =
appropriate. While the `timeout` keyword argument was added to `Regexp.new`=
, this isn't always a viable option.



In the case of regex literal syntax (`/ab*/` or `%r{ab*}`, for instance), i=
t's not possible to set a timeout at all right now without converting to `R=
egexp.new`, which may be awkward depending on the contents of the regex.



It also is desirable from time to time to be able to set a timeout for a re=
gex object after it's been initialized.



Finally, because we offer a `Regexp#timeout` getter, for consistency it wou=
ld be nice to also offer a setter.



The introduction of a `Regexp#timeout=3D` setter was mentioned as a possibl=
e way to set individual timeouts in https://bugs.ruby-lang.org/issues/19104=
#Specification.



# Proposal



I propose that we add the method `Regexp#timeout=3D`. It works the same way=
 the `timeout` argument works in `Regexp.new`, taking either a float or nil.



This makes it relatively easy to add timeouts to specific regex literals (r=
egex literals are frozen by default so you do have to `dup` them first):



```

emoji_filter_pattern =3D %r{

  (?<!#{Regexp.quote(ZERO_WIDTH_JOINER)})

  #{EmojiFilter.unicodes_pattern}

  (?!#{Regexp.union(EmojiFilter::MODIFIER_CHAR_MAP.keys.map { |k| Regexp.qu=
ote k })})

}x.dup

emoji_filter_pattern.timeout =3D 1.0

emoji_filter_pattern.freeze

```



# Implementation



This setter has been implemented in https://github.com/ruby/ruby/pull/7847.



# Evaluation



It's just a setter, so pretty straightforward in terms of implementation an=
d use.



# Discussion



It's worth considering other options for overriding `Regexp.timeout`. I'd l=
ove to see something like the following for overriding regexp timeouts as w=
ell:



```

Regexp.timeout =3D 1.0



Regexp.with_timeout(5.0) do

  evaluate_slower_regexes

end

```



It's possible to implement something like `Regexp.with_timeout` but it's no=
t thread-safe by default since it would involve overwriting `Regexp.timeout=
`.



# Summary



Regexp instances have a getter for timeout, and adding a corresponding sett=
er adds consistency and will make it easier for developers to adopt adding =
a global `Regexp.timeout` by making it simpler to adjust timeouts on a rege=
x by regex basis.



It's a minor change but the added consistency and flexibility help us optim=
ize for developer happiness.







--=20

https://bugs.ruby-lang.org/

 ______________________________________________
 ruby-core mailing list -- [e-mail]
 To unsubscribe send an email to [e-mail]
 ruby-core info -- https://ml.ruby-lang.org/mailman3/postorius/lists/ruby-c=
ore.ml.ruby-lang.org/