The regex that broke a server

I’ve never thought I would see an unresponsive server due to a bad regex matcher but that’s just happened to one of our services, yielding it it unresponsive.

Let’s assume we parse some external dealer car info. We are trying to find all those cars with “no air conditioning” among various available input patterns (but without matching patterns such as “mono air conditioning”).

The regex that broke our service looks like this:

String TEST_VALUE = "ABS, traction control, front and side airbags, Isofix child seat anchor points, no air conditioning, electric windows, \r\nelectrically operated door mirrors";
double start = System.nanoTime();
Pattern pattern = Pattern.compile("^(?:.*?(?:\\s|,)+)*no\\s+air\\s+conditioning.*$");
assertTrue(pattern.matcher(TEST_VALUE).matches());
double end = System.nanoTime();
LOGGER.info("Took {} micros", (end - start) / (1000 ));

After 2 minutes this test was still running and one CPU core was fully overloaded.

regex-overload

First, the matches method uses the entire input data, so we don’t need the start(^) or the end($) delimiters, and because of the new line characters in the input string we must instruct our Regex Pattern to operate in a MULTILINE mode:

Pattern pattern = Pattern.compile("(?:.*?(?:\\s|,)+)*no\\s+air\\s+conditioning.*?", Pattern.MULTILINE);

Let’s see how multiple versions of this regex behave:

Regex Duration [microseconds] Observation
“(?:.*?(?:\\s|,)+)*no\\s+air\\s+conditioning.*?” 35699.334 This is way too slow
“(?:.*?(?:\\s|,)+)?no\\s+air\\s+conditioning.*?” 108.686 The non-capturing group doesn’t need the one-or-many(+) multiplier, so we can replace it with zero-or-one(?)
“(?:.*?\\b)?no\\s+air\\s+conditioning.*?” 153.636 It works for more input data than the previous one, which only uses the space(\s) and the comma(,) to separate the matched pattern
“\\bno\\s+air\\s+conditioning” 78.831 Find is much faster than matches and we are only interested in the first occurrence of this pattern.

Why not using String.indexOf() instead?

While this would be much faster than using regex, we would still have to consider the start of the string, patterns such as “mono air conditioning”, tabs or multiple space characters between our pattern tokens. Custom implementations as such may be faster, but are less flexible and take more time to implement.

Conclusion

Regex is a fine tool for pattern matching, but you must not take it for granted since small changes may yield big differences. The reason why the first regex was counterproductive is due to catastrophic backtracking, a phenomena that every developer should be aware of before starting writing regular expressions.

If you have enjoyed reading my article and you’re looking forward to getting instant email notifications of my latest posts, you just need to follow my blog.

About these ads

7 thoughts on “The regex that broke a server

  1. Since you’re searching for the presence or absence of a static string component, why not use a substring detector? In perl, I’d use index(TEST_VALUE, ‘no air conditioning’ and get back the index of the the starting position of the substring in the larger string, or -1 if it was absent. Betcha an Olympic hockey gold medal it’s faster.

    • While this would be much faster than using regex, we would still have to consider the start of the string, patterns such as “mono air conditioning”, tabs or multiple space characters between our pattern tokens. Custom implementations as such may be faster, but are less flexible and take more time to implement.

  2. Not only is “find much faster than matches” (in your last example) but here you used the proper idiom (\b – word boundary) rather than the convoluted regex suffering from exponential backtrace.

    Conclusion: know thy tools and use the force^M Google! :-)

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s