René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Support `CelOptions.maxRegexProgramSize(int)` to limit RE2 program size","articleBody":"### Feature request checklist\n\n- [x] There are no issues that match the desired change\n- [x] The change is large enough it can't be addressed with a simple Pull Request\n- [x] If this is a bug, please file a [Bug Report](./ISSUE_TEMPLATE).\n\n### Change\nTo make CEL environment setup consistent across CEL implementations, I propose to add `CelOptions.maxRegexProgramSize(int)` to CEL-Java. This option should work similar to `InterpreterOptions.regex_max_program_size` in CEL-Cpp (see nuances below).\n\nRE2 program size should be verified when the CEL program is created from the AST (AFAIK this is [how cel-cpp works](https://github.com/google/cel-cpp/blob/e6ba30e29a51a2fec3e176e24789e6113e1cd2af/runtime/standard/regex_functions.cc)).\n\n### Nuances\nThe program size represents a very approximate measure of a regexp's \"cost\". There are no guarantees on the implementation details or claims about the properties of the program size (except \"larger numbers are more expensive than smaller numbers\"). \n\nCurrently the program size is the same as the number of instructions of the regex program. However, the number of instructions in a regex depends on the concrete RE2 implementation. The implication of using the number of instructions as the program size is that:\n\n\u003e [!IMPORTANT]\n\u003e There's no guarantee that RE2 program size has the exact same value in CPP, Go and Java.\n\u003e We should communicate this in the docs.\n\nFor example:\n```py\n[\"\", \"a\", \"^\", \"^$\", \"a+b\", \"a+b?\", \"(a+b)\", \"a+b.*\", \"(a+b?)\"]  # pattern\n[4,   5,   2,   2,     7,     8,       9,      15,       10]     # program size: cpp re2-2024-07-02\n[3,   3,   3,   4,     5,     6,       7,       7,        8]     # program size: java re2j v1.8 \n[3,   3,   3,   4,     5,     6,       7,       7,        8]     # program size: go v1.24.1\n# (go v1.24.1 is identical to re2j v1.8)\n```\n\n### Context\nUnlike the canonical C++ RE2 implementation, [re2j](https://github.com/google/re2j) (Java RE2 port) didn't expose the program size in [public APIs](https://javadoc.io/doc/com.google.re2j/re2j/latest). To address this inconsistency I made google/re2j#180, and it was recently merged.\n\nWhen the next re2j version is released, we'll be able to determine the program size using `Pattern.programSize()`.\n\n### Example\n```java\nprivate static final CelRuntime CEL_RUNTIME = CelRuntimeFactory\n    .standardCelRuntimeBuilder()\n    .setOptions(CelOptions.current().maxRegexProgramSize(5).build())\n    .build();\n```\n\n```java\n@Test\npublic void regex_maxProgramSize() throws Exception {\n  CelCompiler CEL_COMPILER = CelCompilerFactory.standardCelCompilerBuilder()\n      .setResultType(SimpleType.BOOL)\n      .build();\n\n  String expr = \"matches('foobar', 'a+b?')\";\n  CelRuntime.Program program = CEL_RUNTIME.createProgram(CEL_COMPILER.compile(expr).getAst());\n  CelEvaluationException celErr = assertThrows(CelEvaluationException.class, program::eval);\n  assertThat(celErr.getErrorCode()).isEqualTo(CelErrorCode.INVALID_ARGUMENT);\n}\n```\n\nSome other known regex program sizes for java can be found in re2j's [`PatternTest.java`](https://github.com/google/re2j/blob/2757238ff7144de7ae9bbf707ebc22f9cc3b1249/javatests/com/google/re2j/PatternTest.java#L167-L178.).\n\n### Related\n- google/re2j#180\n- Internal ref: go/grpc-cel-integration\n\nCC @l46kok, @TristonianJones ","author":{"url":"https://github.com/sergiitk","@type":"Person","name":"sergiitk"},"datePublished":"2025-01-07T03:10:22.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":1},"url":"https://github.com/545/cel-java/issues/545"}