You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Normally, regexes like [^\w\W] with empty classes are banned at translation time. But it looks like \P{any} (which is empty) slipped through. So we should just improve the ban to cover that case.
However, empty character classes are occasionally useful constructs for injecting a "fail" sub-pattern into a regex, typically in the context of cases where regexes are generated. Indeed, the NFA compiler in regex-automata handles this case fine:
Where it's impossible to ever move past state 2. Arguably, it might be nicer if it were an explicit "fail" instruction, but an empty sparse instruction (a state with no outgoing transitions) serves the purpose as well.
So once #656 is done, we should be able to relax this restriction.
Specifically, this one:
regex/src/compile.rs
Line 419 in a7ef5f4
Normally, regexes like
[^\w\W]
with empty classes are banned at translation time. But it looks like\P{any}
(which is empty) slipped through. So we should just improve the ban to cover that case.However, empty character classes are occasionally useful constructs for injecting a "fail" sub-pattern into a regex, typically in the context of cases where regexes are generated. Indeed, the NFA compiler in
regex-automata
handles this case fine:Where it's impossible to ever move past state
2
. Arguably, it might be nicer if it were an explicit "fail" instruction, but an empty sparse instruction (a state with no outgoing transitions) serves the purpose as well.So once #656 is done, we should be able to relax this restriction.
This bug was found by OSS-Fuzz.
The text was updated successfully, but these errors were encountered: