owasp-modsecurity / owasp-modsecurity/ModSecurity

Support for RE2 regular expression engine

Open
#1,996 9 comments 6 reactions 1 assignee View on GitHub

@zimmerle is already working on this.

Since Jan 10, 2019.

3.x
Dominant language
C++
Stars
9.8k
Forks
1.8k
Avg merge
2h 46m
Merged PRs (30d)
1

Description

RE2 (https://github.com/google/re2) is a regular expression engine written in C++ and developed by Google.

Unlike libpcre, RE2 runtime is always linear to the size of the input. It comes at some cost: the engine inherently doesn't support certain features, like backreferences and lookaround assertions.

Still, even the CRS has some regular expressions in its rules that run very slowly (minutes) on certain inputs, but are supported by RE2 and run much faster (seconds) on the same inputs.

The idea of adding RE2 support to ModSecurity has been floating around for a while, and there's quite a few mentions of people working on things related to it:

  • SpiderLabs/owasp-modsecurity-crs#1255
  • SpiderLabs/owasp-modsecurity-crs#1130

I have been unable to find neither issue nor public pull request/fork/branch of ModSecurity with RE2 support.

I have a more-or-less working proof-of-concept patch for ModSecurity with optional RE2 support (with fallback to libpcre if the regexp fails to compile on RE2).

Is someone else working on this? Because if yes, it's probably not worth it to duplicate efforts. If not, I think I can clean up my patch a bit and submit it here as a PR.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.