Subject: Possible RegEx security problem.

From: "Nigel Swinson" <[email-masked]>
Date: Thu, 7 Sep 2000 17:48:12 +0100

Hi folks,

In draft-murchison-sieve-regex-02.txt it says

    Security considerations are discussed in [SIEVE].  It is believed
    that this extension doesn't introduce any additional security
    concerns.

What if I write a regular expresssion that may be utterly meaningless, but
processor hungry.  Could we not potentially crash the server as it tries to
match this against part (or all) of the message?

I bring this up as I have just been working with a WIN32 RegEx
implementation that freezes up if you type in the regular expression

  (.*)*

I'd rather not have a user type in this as a regular expression and freeze
up my mail server!

Is this a potential security problem, or have I just had a bad experience
with a bad RegEx implementation?

Nigel

---

From: Tony Hansen <[email-masked]>
Date: Thu, 07 Sep 2000 20:33:49 -0400

I'd call it a bad regex implementation. 

All implementations of anything have the potential of having bugs that
can be exploited for nefarious means. This extension definitely doesn't
introduce any additional concerns along those lines.

	Tony Hansen
	[email-masked]

---

From: Phil Pennock <[email-masked]>
Date: Fri, 8 Sep 2000 09:43:17 +0200

> introduce any additional concerns along those lines.

Aren't regexes inherently more _likely_ to cause optimisation problems
in an implementation, because of the greater expressive power?

But then, it's an extension, so sites which worry about their users
doing this are free to not provide it.  :^)

But should the draft be amended to note that any implementation is
likely to carry a higher processing overhead than the globbing used by
:matches and sites should take this into consideration when deciding
whether or not to provide it?

> > with a bad RegEx implementation?

That level of effect is a bad implementation.  But generally speaking,
regular expression matching is more resource intensive [1] than globbing
or straight string comparison.

[1] Unsubstantiated claim alert.  It's true, honest; I just don't want
    to have to find academic references at this unearthly hour of the
    morning.
-- 
Phil Pennock                        <[email-masked]> <[email-masked]>
Demon Internet Nederland -- Network Operations Centre -- Systems Administrator
Libertes philosophica.
Sales: +31 20 422 20 00                                Support: 0800 33 6666 8