Subject: Re: perl: unsafe empty pattern behavior

From: Jeff Davis <[email-masked]>
Date: Tue, 12 Mar 2024 15:51:09 -0700

On Tue, 2024-03-12 at 18:53 +0100, Alvaro Herrera wrote:
> I suggest that pg_dump/t/002_pg_dump.pl could use a verification that
> the ->{regexp} thing is not empty.

I'm not sure how exactly to test for an empty pattern. The problem is,
we don't really want to test for an empty pattern, because /(?^:)/ is
fine. The problem is //, which gets turned into an actual pattern
(perhaps empty or perhaps not), and by the time it's in the %tests
hash, I think it's too late to distinguish.

Again, I'm not a perl expert, so suggestions welcome.

>   I also tried grepping (for things
> like qr{}, qr[], qr||, qr!!) and didn't find anything beyond what you
> have ... but I only looked for the "qr" literal, not other ways to
> get
> regexes.

I think that's fine. qr// seems the most dangerous, because it seems to
behave differently in different versions of perl.

Grepping for regexes in perl code is an "interesting" exercise.

Regards,
	Jeff Davis

---

From: Tom Lane <[email-masked]>
Date: Tue, 12 Mar 2024 18:59:04 -0400

Jeff Davis <[email-masked]> writes:
>> get regexes.

> behave differently in different versions of perl.

I wonder whether perlcritic has sufficiently deep understanding of
Perl code that it could find these hazards.  I already checked,
and found that there's no built-in filter for this (at least not
in the perlcritic version I have), but maybe we could write one?
The rules seem to be plug-in modules, so you can make your own
in principle.

			regards, tom lane

---

From: Andrew Dunstan <[email-masked]>
Date: Wed, 13 Mar 2024 00:04:49 -0400

> The rules seem to be plug-in modules, so you can make your own

Yeah, that was my thought too. I'd start with ProhibitComplexRegexes.pm 
as a template.

If nobody else does it I'll have a go, but it might take a while.

cheers

andrew

--
Andrew Dunstan
EDB: https://www.enterprisedb.com

---

From: Tom Lane <[email-masked]>
Date: Wed, 13 Mar 2024 00:15:18 -0400

Andrew Dunstan <[email-masked]> writes:
>> Perl code that it could find these hazards.

> Yeah, that was my thought too. I'd start with ProhibitComplexRegexes.pm 

Oooh.  Taking a quick look at the source code:

https://metacpan.org/dist/Perl-Critic/source/lib/Perl/Critic/Policy/RegularExpressions/ProhibitComplexRegexes.pm

it seems like it'd be pretty trivial to convert that from "complain if
regex contains more than N characters" to "complain if regex contains
zero characters".

			regards, tom lane