Documentation
¶
Overview ¶
Package rx provides a regular-expression operator.
It is a package of its own rather than part of rules/op because of the fifth ownership test: an embedder writing gwaf.New() should not link a regex engine because somebody else needed one. Go links per package, so the cost is paid only by code that imports this one — which is the same guarantee that kept this operator inside the seclang module, without the side effect of forcing an embedder who wants one regex rule to take a SecLang parser with it.
Go's regexp is RE2: linear in the length of the input, no backtracking, ReDoS-impossible. That is what makes it safe to evaluate a pattern against attacker-controlled bytes at all, and it is why Cost can be a constant.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ExtractLiterals ¶
ExtractLiterals finds strings without which the pattern cannot match.
The returned set has *any-of* semantics, matching how the engine uses it: every string the pattern matches contains at least one element. An empty result means "unknown", which makes the rule unconditional — that costs latency and is reported, and it is always safe.
It walks the parsed syntax tree rather than the pattern text, so it is exact about what the regex means rather than guessing from characters:
- a literal yields itself;
- a concatenation yields the set of any *one* of its parts, since every part must appear; the most selective part is chosen;
- an alternation yields the union of its branches, and only if every branch yields something, because a branch with no literal can match without any of them;
- a repetition that may match zero times yields nothing;
- a capture or a non-greedy wrapper is transparent.
It is exported because it is useful on its own — a tool that lints a ruleset wants to report which rules will be unconditional before they are compiled.
Types ¶
type Operator ¶
type Operator struct {
// contains filtered or unexported fields
}
Operator is a compiled regular-expression operator.
func MustNew ¶
MustNew is New for package-level rule definitions, where a pattern that does not compile is a build-time defect rather than a runtime condition.
func NewNegated ¶
NewNegated returns an operator matching values the pattern does *not* match.
A negated pattern cannot be prefiltered — it matches on the absence of something, so no byte sequence is required — and is therefore evaluated on every value in its phase. The compile report lists it as unconditional.
func (*Operator) Cost ¶
Cost implements rules.Operator. RE2 is linear in the input, and the engine already charges per byte scanned, so what remains is a constant well above a literal comparison.
func (*Operator) Literals ¶
Literals implements rules.Operator, returning byte sequences without which the pattern cannot match.
This is what keeps a large imported ruleset from destroying the latency budget: rules that all had to run against every value would be exactly the interpreter design gwaf exists not to be. The literals are derived from the pattern's syntax tree rather than asserted by a caller, which removes the one place in the Operator contract where being wrong is silent.
Source Files