Add a built-in RE2 implementation based on re2js by jonbodner-buf · Pull Request #290 · bufbuild/cel-es

jonbodner-buf · 2026-04-21T17:27:06Z

The CEL spec says that its regular expressions meet the RE2 spec, but the existing ES implementation defaults to the regex implementation that's built into ES runtimes, which uses a backtracking implementation that has pathological cases susceptible to ReDOS attacks.

This PR adds a stripped-down version of RE2JS (https://github.com/le0pard/re2js) as a package, and integrates it into CEL as the default regex engine.

…h broken imports.

…eTables.ts

srikrsna

Left some comments regarding the integration. I'll review the RE2 implementation in a second pass.

srikrsna · 2026-04-21T17:37:01Z

+    /\\c[A-Z]/, // control character eg: /\cM\cJ/
+    /\\u[0-9a-fA-F]{4}/, // UTF-16 code-unit
+    /\\0(?!\d)/, // NUL
+    /\[\\b.*\]/, // Backspace eg: [\b]


Why do we need this if it is re2?

srikrsna · 2026-04-21T17:37:32Z

+    // can probably delete this since the RE2 engine will already reject them, but keep for now
+    for (const invalidPattern of invalidPatterns) {
+        if (invalidPattern.test(pattern)) {
+            throw new Error(
+                `Error evaluating pattern ${pattern}, invalid RE2 syntax`,
+            );
+        }


I think we should delete them

srikrsna · 2026-04-21T17:41:48Z

-  }
-  const re = new RegExp(pattern, flags);
-  return re.test(this);
+    const re: RE2JS = RE2JS.compile(pattern, flagVal);


My understanding is that flags are part of the syntax in RE2? Can we add support for them in the library instead of trying to identify them here? Or am I missing something?

cel-go also passes them directly to regex engine without any preprocessing: https://github.com/google/cel-go/blob/646cdc1728643aec9499e3a00236ef1007a5d3fa/common/types/string.go#L156

yeah, not needed. Removing the code.

srikrsna · 2026-04-21T17:43:44Z

+    "@bufbuild/re2": "0.4.0"
  },
  "devDependencies": {
+    "@unicode/unicode-16.0.0": "^1.6.16",


Is this a peer dependency that is required?

no, removed.

srikrsna · 2026-04-21T17:43:55Z

    "peggy": "^5.0.6",
    "peggy-ts": "github:hudlow/peggy-ts#v0.0.9",
-    "expect-type": "^1.3.0"
+    "unicode-property-value-aliases": "^3.9.0"


Is this a peer dependency that is required?

no, removed.

srikrsna · 2026-04-21T17:45:19Z

+    "@unicode/unicode-16.0.0": "^1.6.16",
+    "unicode-property-value-aliases": "^3.9.0"


I see that these are added as dev dependencies in the cel package as well, will users end up needing them?

no, they are used for tests and to build a unicode lookup table.

srikrsna · 2026-04-21T17:45:58Z

+  },
+  "dependencies": {
+    "@bufbuild/re2": "^0.1.0"


I don't think this is needed here.

I think it's needed? The cel package now depends on the re2 package to run.

But this is the root workspace package.json not for the CEL package.

oh! yes, this should go.

srikrsna · 2026-04-29T04:20:00Z


 // biome-ignore format: table
 export default [
-  // !


We should revert the formatting changes here. It was deliberately formatted like this for readability

yeah, this wasn't intentional. I'll revert it.

srikrsna · 2026-04-29T04:21:13Z

  SemanticAdorner,
  toDebugString,
-} from "@bufbuild/cel-spec/testdata/to-debug-string.js";
+} from "../../cel-spec/dist/cjs/testdata/to-debug-string.js";


Suggested change

} from "../../cel-spec/dist/cjs/testdata/to-debug-string.js";

} from "@bufbuild/cel-spec/testdata/to-debug-string.js";

srikrsna · 2026-04-29T04:25:16Z

+
+## Credits
+This code is a fork of the [RE2JS](https://re2js.leopard.in.ua) project. It has been converted to TypeScript and has a feature set tailored for
+CEL and Protovalidate-es.


I don't think it does anything special for protovalidate, does it?

Suggested change

CEL and Protovalidate-es.

CEL.

Not yet, but when native rules are added to protovalidate-es, we will want to use the re2 engine for string pattern rules. Agree that we should remove that for now.

timostamm · 2026-04-29T10:25:47Z

-    pattern = pattern.substring(flagMatches[0].length);
-  }
-  const re = new RegExp(pattern, flags);
+  const re: RE2JS = RE2JS.compile(pattern);


Seconding Krishna's comment - return RE2JS.compile(pattern).test(this); is idiomatic style.

timostamm · 2026-04-29T10:28:20Z

-  celMethod(olc.ENDS_WITH,    STRING, [STRING],       BOOL, String.prototype.endsWith),
-  celMethod(olc.STARTS_WITH,  STRING, [STRING],       BOOL, String.prototype.startsWith),
-  celMethod(olc.MATCHES,      STRING, [STRING],       BOOL,  matches),
+    // !


The previous formatting looks more readable to me, and there's a formatter ignore comment on line 86 to keep it. Any reason to change the formatting? If yes, let's drop the formatter ignore.

timostamm · 2026-04-29T10:35:44Z

  SemanticAdorner,
  toDebugString,
-} from "@bufbuild/cel-spec/testdata/to-debug-string.js";
+} from "../../cel-spec/dist/cjs/testdata/to-debug-string.js";


This can break in subtle and mysterious ways. Need to keep the previous import.

timostamm · 2026-04-29T12:22:46Z

+  "include": ["src/**/*.test.ts"],
+  "exclude": ["./src/__tests__", "./src/__fixtures__", "./src/__utils__"]


This is broken - the exclude means we aren't catching any compiler errors in tests, fixtures, or utils.

timostamm · 2026-04-29T12:35:40Z

+dist/*/testing.js
+dist/*/testing.d.ts


Those two lines aren't needed here. The picture will change with a fixed tsconfig.json that includes tests and fixtures.

jonbodner-buf added 8 commits April 17, 2026 15:31

add re2js to codebase. change logic.ts to call it. fix some tests wit…

b788755

…h broken imports.

fix imports

1872bae

move re2 to its own package. add LICENCE and initial README.md

9a4a332

update version in package-lock.json

cbcc87b

fix formatting. start fixing lint errors.

e768b44

additional lint updates

0eac393

finish lint changes

100f4db

add test to validate unicode range tables. fix delta ranges in Unicod…

6554cea

…eTables.ts

jonbodner-buf requested a review from srikrsna-buf April 21, 2026 17:27

srikrsna reviewed Apr 21, 2026

View reviewed changes

jonbodner-buf added 5 commits April 21, 2026 13:55

fix formatting. remove unused methods, constants, and files.

dd34db0

revert import change in checker.test.ts

cccca46

don't put license headers on the re2 files

1fc17e8

updates for PR

68ce0a3

remove unneeded dependency from root package.json.

af39200

srikrsna reviewed Apr 29, 2026

View reviewed changes

timostamm reviewed Apr 29, 2026

View reviewed changes

timostamm and others added 3 commits April 29, 2026 16:42

Fix exports (#292)

2684e25

Merge branch 'main' into jonbodner/add_re2

506d9a9

address code review issues

5530de2

jonbodner-buf force-pushed the jonbodner/add_re2 branch from c008b4c to 5530de2 Compare April 29, 2026 16:58

		"@unicode/unicode-16.0.0": "^1.6.16",
		"unicode-property-value-aliases": "^3.9.0"

	} from "../../cel-spec/dist/cjs/testdata/to-debug-string.js";
	} from "@bufbuild/cel-spec/testdata/to-debug-string.js";

		"include": ["src/*/.test.ts"],
		"exclude": ["./src/__tests__", "./src/__fixtures__", "./src/__utils__"]

		dist/*/testing.js
		dist/*/testing.d.ts

Conversation

jonbodner-buf commented Apr 21, 2026

Uh oh!

srikrsna left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

srikrsna Apr 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

srikrsna Apr 25, 2026 •

edited

Loading