envoyproxy / envoyproxy/java-control-plane
Heads up: max_program_size deprecation will require re2j changes to allow validation
- Langage dominant
- Java
- Étoiles
- 312
- Forks
- 149
- Métriques de merge des PR
- Aucune PR mergée en 30 j
Description
This is just documenting the information that may be necessary if java-control-plane wants to start validating regular expression [max_program_size](https://github.com/envoyproxy/envoy/blob/1d03d302ba9670d04cc8c731393be90ff7b47f2f/api/envoy/type/matcher/regex.proto#L23)s. __This is unnecessary if the regular expressions are considered "trusted"__ (known to be non-malicious).
I had this information and wanted to dump it somewhere that it may be useful if the need arises. It _seems_ there is no explicit management of GoogleRE2 in this repo. Feel free to close.
-----
In https://github.com/envoyproxy/envoy/pull/10971, Envoy deprecated the max_program_size configuration field in favor of the control plane being responsible. This is great, and works for C++ and Go languages, but leaves some TODOs for Java.
The C++ re2 exposes [RE2::ProgramSize()](https://github.com/google/re2/blob/e48b461c1e3e09574300587672c2498b77bc24dc/re2/re2.h#L300-L302) which reports [the number of instructions](https://github.com/google/re2/blob/e48b461c1e3e09574300587672c2498b77bc24dc/re2/prog.cc#L631) of the compiled regular expression. This is the "program size" that Envoy was referring to.
Go's `regexp/syntax` package allows getting something similar:
```
regex, err := syntax.Parse("INPUT HERE", 0)
prog, err := syntax.Compile(regex)
len(prog.Inst) // this is the program size
```
But it does not appear re2j supports such a feature. Basically, you will need a new Pattern method that [returns the length of `Prog.inst`](https://github.com/google/re2j/blob/9708be1d64e75cd096352e08724dc596666040dc/java/com/google/re2j/Prog.java#L17) (via re2.prog).
Guide de contribution
Ouvrir le guide de contribution
Piste de recherche
L’issue pointe vers Pattern et Prog.inst de re2j, tout en précisant que ce dépôt ne gère peut-être pas explicitement GoogleRE2. Vérifie d’abord si java-control-plane dispose d’un point d’entrée de validation pour la taille des programmes regex ; pour considérer le travail terminé, il faudrait confirmer si une implémentation est nécessaire et définir la portée de toute modification pertinente de re2j.
Rédigé par le modèle d'indexation à partir du texte de l'issue.
Évaluation
- Stack technique
- java
- Domaine
- backend
- Type d'issue
- Documentation
- Difficulté
- 5/5
- Temps estimé
- Plus d'une semaine
- Activité
- À l'abandon
- Clarté
- À clarifier
- Accessibilité débutants
- 25/100