René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Quadratic regex in readline.js","articleBody":"Version: master branch\r\nSubsystem: readline\r\n\r\n`lib/readline.js` contains this code snippet:\r\n\r\n```\r\nInterface.prototype._wordLeft = function() {\r\n  if (this.cursor \u003e 0) { \r\n    var leading = this.line.slice(0, this.cursor);\r\n    var match = leading.match(/(?:[^\\w\\s]+|\\w+|)\\s*$/);\r\n    this._moveCursor(-match[0].length);\r\n  }\r\n};\r\n```\r\n\r\nThis regex is quadratic: `/(?:[^\\w\\s]+|\\w+|)\\s*$/`.\r\n\r\nI would be shocked if this were a viable ReDoS vector (hence the public bug report), but if `this.line` can be long (100K chars?) then it might present a performance problem.\r\n\r\nI have not investigated reachability/triggerability nor the use cases of readline.","author":{"url":"https://github.com/davisjam","@type":"Person","name":"davisjam"},"datePublished":"2019-03-11T18:18:25.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":6},"url":"https://github.com/26596/node/issues/26596"}