Kristian Rickert created OPENNLP-1925:
-----------------------------------------
Summary: Harden RegEx Tests + RegEx exception note
Key: OPENNLP-1925
URL: https://issues.apache.org/jira/browse/OPENNLP-1925
Project: OpenNLP
Issue Type: Bug
Reporter: Kristian Rickert
Assignee: Kristian Rickert
OpenNLP's processing path is RegEx-free by policy. {{RegexNameFinder}} and
{{RegexNameFinderFactory}} are the deliberate exception: their entire purpose
is regular-expression matching. This change records that exception in the class
Javadoc of both classes:
{quote}Please note: RegEx is not allowed in the processing path of OpenNLP.
However, a RegEx step is an obvious exception.{quote}
The same change hardens {{testBuiltinPatternsAreNotVulnerableToReDoS}} (added
in OPENNLP-1922). The single test ran all five attack inputs inside one
2-second wall-clock budget. On a throttled or cold CI executor, JVM warmup
alone can consume the budget before the match itself runs (observed: 2.372s
against a 2.0s budget on a workload that takes 30ms warm), and a failure did
not name the input that got slow.
Each attack now runs as its own parameterized case with one warmup pass outside
the timed section. The 2-second budget per case acts purely as a hang guard;
against the pre-OPENNLP-1922 patterns the warmup pass itself hangs or overflows
the stack, so the test still goes red on a regression.
h3. Benchmark evidence
|| Workload || Old patterns || Hardened patterns ||
| Attack suite, all five inputs | hang (>10s) or StackOverflowError per input |
30ms total, slowest ~10ms |
| Normal text scan, EMAIL, 1MB | 131ms | 25ms |
| Normal text scan, URL, 1MB | 18ms | 15ms |
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
