Details

      Description

      When complex REGEX is used, timeout setting is ignored and the query can take way longer than timeout setting allows. Example:

      SELECT (REGEX("xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "(x+x+)+y") AS ?b) {}
      

      This probably happens because the engine uses java.util.regex which ignores interrupts (e.g. https://stackoverflow.com/q/7125732/214196) so even though timeout expires, regex continues to run. This has DoS potential for public endpoints.

        Issue Links

          Activity

          Hide
          stasmalyshev stasmalyshev added a comment -
          Show
          stasmalyshev stasmalyshev added a comment - Pull request: https://github.com/blazegraph/database/pull/72
          Show
          beebs Brad Bebee added a comment - https://github.com/blazegraph/bigdata/pull/527

            People

            • Assignee:
              beebs Brad Bebee
              Reporter:
              stasmalyshev stasmalyshev
            • Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: