[Bug manual/25973] New: Document regex security posture in man page

[Bug manual/25973] New: Document regex security posture in man page

[dpmendenhall at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=25973

            Bug ID: 25973
           Summary: Document regex security posture in man page
           Product: glibc
           Version: 2.27
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: manual
          Assignee: unassigned at sourceware dot org
          Reporter: dpmendenhall at gmail dot com
                CC: mtk.manpages at gmail dot com
  Target Milestone: ---

https://sourceware.org/glibc/wiki/Security%20Exceptions states:

"Implementing regular expressions efficiently, in a standard-conforming way,
and without denial-of-service vulnerabilities is very difficult and impossible
for Basic Regular Expressions. Most implementation strategies have issues
dealing with certain classes of patterns.

Consequently, resource exhaustion issues which can be triggered only with
crafted patterns (either during compilation or execution) are not treated as
security bugs."

Fair enough, but it would be helpful for this to be clearly documented in the
man pages too, like regex(7). Currently there is only a subtle reference under
bugs which doesn't use the word 'security' at all:

"Back references are a dreadful botch, posing major problems for efficient
implementations.  They are also somewhat vaguely defined (does
"a\(\(b\)*\2\)*d" match "abbbd"?).  Avoid using them."

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug manual/25973] Document regex security posture in man page

[dpmendenhall at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=25973

David Mendenhall <dpmendenhall at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |FIXED

--- Comment #1 from David Mendenhall <dpmendenhall at gmail dot com> ---
regex(7) owned by Linux man-pages, not glibc.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug manual/25973] Document regex security posture in man page

[dpmendenhall at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=25973

David Mendenhall <dpmendenhall at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|FIXED                       |INVALID

--- Comment #2 from David Mendenhall <dpmendenhall at gmail dot com> ---
regex(7) owned by Linux man-pages, not glibc.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug manual/25973] Document regex security posture in man page

[schwab@linux-m68k.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=25973

Andreas Schwab <schwab@linux-m68k.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|INVALID                     |MOVED

-- 
You are receiving this mail because:
You are on the CC list for the bug.