It's a Bad Idea (TM) to compile a regular expression from an untrusted input.
replyDespite what anyone would try to sell you, a regular expression is a programming language. It's Always A Bad Idea (TM) to compile untrusted input into any kind of programming language. Don't string concatenate SQL queries, eval is evil, it's all the same idea.
A regex might be a programming language, a proper regular expression (which there are libraries for, like Google RE2) is just a regular language and I don't think you can even charitably call that a programming language.
replyWhy is it a bad idea, for either of those? Fundamentally?
reply> It's a Bad Idea (TM) to compile a regular expression from an untrusted input.
replyi agree with you!
nevertheless,
> where we nevertheless treated a double free in Regexp compilation as a vulnerability after a comprehensive assessment
not sure what sort of comprehensive assessment is still called for at this point?