regex DoS in postgresql?

From: Stuart McGraw <smcg4191(at)mtneva(dot)com>
To: "pgsql-general(at)postgresql(dot)org" <pgsql-general(at)postgresql(dot)org>
Subject: regex DoS in postgresql?
Date: 2019-03-03 04:11:16
Message-ID: dbc6cd12-8147-a66d-9471-eed4df3a8292@mtneva.com
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-general

I would like to deploy a web application with a Postgresql backend
that allows a user to both add a record containing arbitrary text,
and to search that text column with an arbitrary regular expression.

My question is, is the app subject to a regex denial of service attack?

I would have presumed so but I have been unable produce any problems
when testing using the "evil" regexs described in the Wikipedia
article on the subject: https://en.wikipedia.org/wiki/ReDoS

Is there something in the way Postgresql implements its RE engine
that makes it immune to this attack?

Thanks for any enlightenment...

Responses

Browse pgsql-general by date

  From Date Subject
Next Message Tom Lane 2019-03-03 05:05:17 Re: regex DoS in postgresql?
Previous Message Eugen Stan 2019-03-03 00:08:51 support for JSON Web Token