New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
the re module can perform poorly: O(2**n) versus O(n**2) #44592
Comments
in short, the re module can degenerate to really really horrid performance. See this for how and why: http://swtch.com/~rsc/regexp/regexp1.html exponential decline instead of squared. I don't have a patch so i'm filing this bug as a starting point for future work. The Modules/_sre.c files implementation could be updated to use the parallel stepping Thompson approach instead of recursive backtracking. filing this as a bug until me or someone else comes up with a patch. |
I would file this under "feature request"; the current situation isn't so much buggy, as slow. While you can produce a segfault with the current regular expression engine (due to stack overflow), you can do the same thing with regular Python on Linux (with sys.setrecursionlimit), ctypes, etc., and none of those are considered as buggy. My only concern with such a change is that it may or may not change the semantics of the repeat operators '*' and '+', which are currently defined as "greedy". If I skimmed the article correctly late at night, switching to a Thompson family regular expression engine may result in those operators no longer being greedy. Please correct me if I am wrong. |
yeah this is better as a feature request. certianly low priority either way. -nothing- I propose doing would change the syntax or behaviour of existing regular expressions at all. Doing so would be a disaster. thompson nfa does not imply changing the behaviour. anyways its a lot more than a simple "patch" to change the re module to not use backtracking so i expect this to languish unless someone has a of free time and motivation all at once. :) |
Just a note for those who think this is a purely theoretical issue: We've been using the python-markdown module on our web app for a while, |
here are two other bug reports about the same issue: |
Not sure if this is a real-world case of this in particular, but possibly: |
This has been addressed in issue bpo-2636. |
Are you sure about this? Does the proposed new regex engine use Thompson |
The new code includes some extra checks which, although not foolproof, |
Here's an easy way to trigger the poor performance. Tested with 2.5, re.compile( '(\s+.*)*x' ).search( 'a ' * 30 ) |
I'm still tinkering with my regex engine (issue bpo-2636). Some timings: re.compile(r'(\s+.*)*x').search('a ' * 25) regex.compile(r'(\s+.*)*x').search('a ' * 25) |
Another example from bpo-11307 |
Given the number of times this comes up, I think it's a least worth an upgrade from 'low' priority to 'normal' priority. |
Note this can be used for denials of service: see http://bugs.python.org/issue17980 |
The recommendation for anyone using regular expressions on hostile input is to (a) don't do that. (b) use a better regexp without this possible behavior and (c) use something like re2 (there's a Python binding at https://github.com/axiak/pyre2) which is a regular expression engine that this cannot happen to. fixing this within python requires a complete rewrite and replacement of the re module with one that uses a different approach. see the other work on the MRAB regex module and discussion surrounding that. that is a non trivial task and it is fixing other more important things (unicode correctness!) than this... Given that, I don't actually expect this issue to ever be fixed. IMNSHO: People shouldn't abuse regexes and get themselves into this situation in the first place. ;) discussion should really happen on python-ideas. |
Note that https://pypi.python.org/pypi/re2 exists today as well and offers a re module compatible interface. I haven't tried it. |
https://pypi.org/project/pyre2/ seems to be a maintained version of that for use on modern Python interpreters. |
Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.
Show more details
GitHub fields:
bugs.python.org fields:
The text was updated successfully, but these errors were encountered: