From 3b73d98c47ff3ba8650ddfc13a0658c07fb3bab3 Mon Sep 17 00:00:00 2001 From: Elara Musayelyan Date: Mon, 30 May 2022 13:55:50 -0700 Subject: [PATCH] Add note about ReDoS to README --- README.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/README.md b/README.md index d3eb510..270a91d 100644 --- a/README.md +++ b/README.md @@ -6,6 +6,12 @@ This package provides a CGo-free port of the PCRE2 regular expression library. T --- +## IMPORTANT NOTE! + +Due to the use of PCRE2, this library contains extra features such as lookaheads/lookbehinds. The stdlib regex engine, RE2, left these features out for a reason. It's easy to create regular expressions with this library that have exponential runtime. This creates the possibility of a denial of service attack. Only use this library if the extra features are needed and the user providing the regex is trusted (such as if it's in a config file). Otherwise, use the standard library regexp package. + +--- + ## Supported GOOS/GOARCH: - linux/amd64