feat: Implement ReDoS-safe regex scanning provider #644
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- **Core Provider Implementation:** Added a `RegexProvider` struct and associated methods (`NewRegexProvider`, `Scan`) in `candle-binding/regex_provider.go`. This includes configurable pattern definitions, input length validation, and support for case-insensitive matching. - **Robust Timeout Mechanism:** The `Scan` method now incorporates a context-aware timeout to ensure regex operations do not exceed a predefined duration. A `WithTestDelay` functional option was introduced to enable reliable testing of this timeout behavior. - **Comprehensive Testing:** Unit tests in `candle-binding/regex_provider_test.go` validate configuration, matching logic, case-insensitivity, input limits, and the timeout mechanism. A dedicated `ReDoSAttackVector` test confirms the provider’s resilience against known ReDoS patterns. - **Performance Benchmarks:** A new benchmark file, `candle-binding/regex_provider_bench_test.go`, measures the `Scan` method’s performance across various scenarios (single/multi-pattern, large input). Signed-off-by: Srinivas A <56465971+srini-abhiram@users.noreply.github.com>
Signed-off-by: Srinivas A <56465971+srini-abhiram@users.noreply.github.com>
✅ Deploy Preview for vllm-semantic-router ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
szedan-rh
pushed a commit
to szedan-rh/semantic-router
that referenced
this pull request
Nov 19, 2025
* feat: Implement ReDoS-safe regex scanning provider - **Core Provider Implementation:** Added a `RegexProvider` struct and associated methods (`NewRegexProvider`, `Scan`) in `candle-binding/regex_provider.go`. This includes configurable pattern definitions, input length validation, and support for case-insensitive matching. - **Robust Timeout Mechanism:** The `Scan` method now incorporates a context-aware timeout to ensure regex operations do not exceed a predefined duration. A `WithTestDelay` functional option was introduced to enable reliable testing of this timeout behavior. - **Comprehensive Testing:** Unit tests in `candle-binding/regex_provider_test.go` validate configuration, matching logic, case-insensitivity, input limits, and the timeout mechanism. A dedicated `ReDoSAttackVector` test confirms the provider’s resilience against known ReDoS patterns. - **Performance Benchmarks:** A new benchmark file, `candle-binding/regex_provider_bench_test.go`, measures the `Scan` method’s performance across various scenarios (single/multi-pattern, large input). Signed-off-by: Srinivas A <56465971+srini-abhiram@users.noreply.github.com> * fix(lint): fix pre-commit Signed-off-by: Srinivas A <56465971+srini-abhiram@users.noreply.github.com> --------- Signed-off-by: Srinivas A <56465971+srini-abhiram@users.noreply.github.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
FIX #365
Make sure the code changes pass the pre-commit checks.
Sign-off your commit by using
-swhen doinggit commitTry to classify PRs for easy understanding of the type of changes, such as
[Bugfix],[Feat], and[CI].Core Provider Implementation: Added a
RegexProviderstruct and associated methods (NewRegexProvider,Scan) incandle-binding/regex_provider.go. This includes configurable pattern definitions, input length validation, and support for case-insensitive matching.Robust Timeout Mechanism: The
Scanmethod now incorporates a context-aware timeout to ensure regex operations do not exceed a predefined duration. AWithTestDelayfunctional option was introduced to enable reliable testing of this timeout behavior.Comprehensive Testing: Unit tests in
candle-binding/regex_provider_test.govalidate configuration, matching logic, case-insensitivity, input limits, and the timeout mechanism. A dedicatedReDoSAttackVectortest confirms the provider’s resilience against known ReDoS patterns.Performance Benchmarks: A new benchmark file,
candle-binding/regex_provider_bench_test.go, measures theScanmethod’s performance across various scenarios (single/multi-pattern, large input).