Standardize on RE2 for regexes that run over external input

We already depend on google-re2 and use it in a handful of modules (HogQL property matching, the logs query runner, path cleaning suggestions, the SFTP source). Most other code uses the stdlib re module. There is no written rule for which one to pick.

RE2 runs in linear time on every input. That removes a whole class of performance bugs where a pattern behaves well on the input we expect and badly on input we do not. The cost is syntax: RE2 has no lookahead, lookbehind, backreferences, or atomic groups, so it is not a drop-in for every pattern.

Proposal

Make RE2 the default for any regex whose subject string comes from outside the codebase. Keep stdlib re for patterns over data we generate ourselves, or where the pattern needs backtracking features.

Work

• Write the rule into the coding conventions, with the RE2 syntax limits.
• Migrate existing call sites that match the rule. Each one is one of: swap the import, rewrite the pattern to be linear-time, or keep stdlib and add a comment saying why.
• Check whether a lint rule can enforce this for new code.
• The Node side has the same question with the re2 package. Worth doing, but a separate decision.

Out of scope

Replacing the regex engine repo-wide. stdlib re is fine for patterns over data we control.

Context

Discussed in this Slack thread.