Does SafeRegex in ColdFusion 2023 Update 26 silently fail when a regex is over 1000 characters?

Question

Hi All,After applying ColdFusion 2023 Update 26 (2023,0,26,331018)) to our application, I found that the ReReplace method stops matching when the regex pattern is over 1000 characters. This seems to be the new SafeRegex limit introduced in this patch https://guides.adobe.com/coldfusion/en/docs/install-and-configure-coldfusion/coldfusion-2023-release-update-26.html.This has caused a bug in our application in a ReReplace method, which was using a regex more than 1000 characters long. The simple fix is to use something like Replace() instead. Alternatively, the patch mentions:-Dcoldfusion.saferegex.maxpatternlen, which defaults to 1000.Setting the flag and increasing the limit beyond 1000 also fixes the issue. My questions:Is this silent behaviour intended or is this a bug? It just returns the original string unchanged	Why has a limit of 1000 been enforced for regex? Are there wider security repercussions for using longer regex patterns?Thanks

Charlie Arehart · Answer

​@Junaid32092262a1i8, good for you in finding the tech note's indicated jvm arg.As for why the limit was imposed, we never hear that. But this is something we've seen this before with other settings (like max post parameters/form fields), where somehow their allowing an unlimited length could be exploited so they set an arbitrary limit, which you can change. (One could wish they'd add admin settings rather than just jvm args, but some will feel otherwise.)As for it failing silently (returning the string unchanged), I'd agree that should be considered a bug. They may well write a line to one of cf logs, but that doesn't help a developer known of or handle the problem. I'd recommend you file a ticket at tracker.adobe.com, and offer the ID here so that interested readers can vote.

Sign up

To post, reply, or follow discussions, please sign in with your Adobe ID.

Sign in to Adobe Community

To post, reply, or follow discussions, please sign in with your Adobe ID.