Dart's built-in regex engine vulnerable to ReDoS; RE2 FFI binding offers linear-time fix

·1 views

Dart's default RegExp engine uses backtracking, which can cause catastrophic slowdowns on certain inputs — a vulnerability known as ReDoS. A 31-character crafted string takes over 5 seconds to reject against a common word-list validator pattern, and some patterns never finish at all. Google's RE2 library, now available as a Dart FFI package, matches in linear time regardless of input, processing the same 31-character case in about 25 microseconds. Unlike dart:core's RegExp, RE2 rejects unsafe patterns such as backreferences at construction time rather than failing silently under load. The package also provides utilities like Re2.escape() and a compiled program size cap to further protect against untrusted input.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Swift Classes Use Reference Types, Meaning Copies Share the Same Data

In Swift, classes are reference types, so assigning a class instance to a new variable does not create an independent copy of the data. Both variables point to the same memory location, meaning a change made through one variable is reflected in the other. This contrasts with structs, which are value types that produce fully independent copies when assigned. The reference-type behavior is intentional and useful for managing shared state across multiple parts of an app, such as a user profile displayed on several screens. Developers who need a true independent copy of a class instance must manually implement a copy method that initializes a new instance with the same values.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Popular JSON minifiers silently corrupt large integers above JavaScript's safe limit

A flaw in widely used JSON minifiers causes large integers — such as database or Snowflake IDs — to be silently altered when processed through JavaScript's JSON.parse and JSON.stringify methods. Any integer exceeding Number.MAX_SAFE_INTEGER (9007199254740991) can lose precision without triggering an error, producing output that is syntactically valid but numerically incorrect. This can cause hard-to-trace bugs when corrupted IDs are used in database lookups, API calls, or foreign key references downstream. The root cause is the parse-then-stringify round-trip approach most minifiers rely on, which converts JSON numbers into JavaScript floating-point values. The recommended fix is to minify JSON at the character level — stripping only whitespace — so number literals are preserved exactly as written in the original input.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

DeepShrink lets users compress video to an exact file size with one command

DeepShrink is an open-source command-line tool written in Rust that compresses video and audio files to a user-specified size limit without uploading files to external servers. The tool works by driving ffmpeg under the hood, automatically calculating the required bitrate and running a two-pass H.264/H.265 encode to guarantee the output meets the target size. Users simply specify a file and a size limit, such as 8 MB for Discord, and DeepShrink handles all technical parameters including codec selection and audio bitrate. It also supports an optional VMAF quality floor to prevent over-compression, and the original file is never modified unless the user explicitly requests it. DeepShrink is available via Homebrew on macOS or through Rust's cargo package manager, with cross-platform ffmpeg installation required for the latter.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Launches 'hallint' to Catch Security Bugs Introduced by AI Coding Tools

A developer has released hallint, a free open-source static analysis tool designed to detect security vulnerabilities commonly introduced by AI coding assistants such as GitHub Copilot, Cursor, and ChatGPT. Unlike traditional linters built for human-written code, hallint targets recurring AI-specific failure patterns including hardcoded secrets, SQL injection via template literals, missing authentication middleware, and overly permissive CORS settings. The tool supports JavaScript, TypeScript, and Python codebases and ships with 11 targeted security rules spanning critical, high, and medium severity levels. It uses three detection layers — regex matching, AST analysis, and an optional LLM-based semantic review via providers like OpenAI, Anthropic, or a local Ollama instance. hallint is available as both a CLI tool and a TypeScript library that can be integrated into existing development workflows.

0 comments Read more at DEV Community