[
https://issues.apache.org/jira/browse/OPENNLP-1925?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Richard Zowalla updated OPENNLP-1925:
-------------------------------------
Fix Version/s: addons-1.6.0
> Harden RegEx Tests + RegEx exception note
> -----------------------------------------
>
> Key: OPENNLP-1925
> URL: https://issues.apache.org/jira/browse/OPENNLP-1925
> Project: OpenNLP
> Issue Type: Bug
> Reporter: Kristian Rickert
> Assignee: Kristian Rickert
> Priority: Major
> Fix For: addons-1.6.0
>
> Time Spent: 50m
> Remaining Estimate: 0h
>
> OpenNLP's processing path is RegEx-free by policy. {{RegexNameFinder}} and
> {{RegexNameFinderFactory}} are the deliberate exception: their entire purpose
> is regular-expression matching. This change records that exception in the
> class Javadoc of both classes:
> {quote}Please note: RegEx is not allowed in the processing path of OpenNLP.
> However, a RegEx step is an obvious exception.{quote}
> The same change hardens {{testBuiltinPatternsAreNotVulnerableToReDoS}} (added
> in OPENNLP-1922). The single test ran all five attack inputs inside one
> 2-second wall-clock budget. On a throttled or cold CI executor, JVM warmup
> alone can consume the budget before the match itself runs (observed: 2.372s
> against a 2.0s budget on a workload that takes 30ms warm), and a failure did
> not name the input that got slow.
> Each attack now runs as its own parameterized case with one warmup pass
> outside the timed section. The 2-second budget per case acts purely as a hang
> guard; against the pre-OPENNLP-1922 patterns the warmup pass itself hangs or
> overflows the stack, so the test still goes red on a regression.
> h3. Benchmark evidence
> || Workload || Old patterns || Hardened patterns ||
> | Attack suite, all five inputs | hang (>10s) or StackOverflowError per input
> | 30ms total, slowest ~10ms |
> | Normal text scan, EMAIL, 1MB | 131ms | 25ms |
> | Normal text scan, URL, 1MB | 18ms | 15ms |
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
