All 7 Regular Expressions in PHP questions
More in Regular Expressions in PHP
What do common regular expression metacharacters like the dot, asterisk, and plus sign mean, and how are they used to build flexible matching patterns? How does preg_replace let you find and replace text matching a regular expression pattern, and how do capture groups let you reuse parts of the matched text in the replacement? How does preg_split let you break a string apart into an array using a regular expression as the delimiter, and how does this differ from PHP's simpler explode function? What are named capture groups in a regular expression, and how do they improve the readability of extracted match data compared to using only numbered groups? When should a developer prefer using a dedicated parser or a simpler string function over a complex regular expression, particularly for structured formats like HTML or JSON?
Advertisement
Back to results for “Security”
PHP › Regular Expressions in PHP

What is catastrophic backtracking in regular expressions, and how can a poorly constructed pattern cause a severe performance problem or even hang a PHP application?

Advanced

Answer

Catastrophic backtracking occurs when a regular expression pattern containing nested or ambiguous repetition, such as multiple overlapping quantifiers that could match the same text in many different possible ways, is applied to certain input strings, causing the regular expression engine to explore an enormous, exponentially growing number of possible matching combinations before finally failing, which can consume massive amounts of processing time and effectively hang the application, making it important to carefully design patterns, particularly those handling user supplied input, to avoid this kind of ambiguous, deeply nested repetition.
// Potentially catastrophic pattern with nested quantifiers
// preg_match('/^(a+)+$/', $userInput);
// A carefully crafted malicious input could cause this to hang
Real-world example A security review flags a regular expression pattern used to validate user input as vulnerable to catastrophic backtracking, and the team rewrites the pattern using a more carefully constrained, unambiguous structure to eliminate the risk of a malicious input causing a denial of service.

Common follow-ups: How do you identify whether a specific regular expression pattern is vulnerable to catastrophic backtracking?;What tools or techniques help test a pattern's performance against a wide range of adversarial inputs?

Security;Performance Optimization & OPcache
All 7 Regular Expressions in PHP questions