Anand Krishnamoorthi 87f22a79ca fix: harden regex builtins with compiled-size limit (#705) ...

Add a 100KB cap on compiled regex NFA size via RegexBuilder::size_limit()
to block patterns that blow up in memory or CPU. Regex compilation now
goes through a single helper (compile_regex_for_builtin) so the limit
is enforced consistently across all regex builtins.

While doing this, found and fixed a pre-existing bug: resource-limit
errors (time, memory, instruction count) raised inside builtins were
quietly swallowed to Undefined when strict_builtin_errors was off
(the default). This is a problem because `not regex.match(...)` would
see Undefined and flip to true -- silently wrong. The same issue now
applies to the new regex size limit.

Fixed by teaching the three error-absorption paths (interpreter builtin
call, RVM builtin dispatch, and RVM rule-execution loop) to recognize
LimitError and let it propagate instead of eating it.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

2026-05-04 15:20:29 -05:00

..

rego

fix: harden regex builtins with compiled-size limit (#705)

2026-05-04 15:20:29 -05:00

vm

feat(rvm): implement Azure Policy condition evaluation (#661)

2026-04-07 19:04:24 -05:00

compiler.rs

refactor: consolidate RVM instruction variants and clean up VM internals (#651)

2026-04-01 05:34:33 -05:00

mod.rs

RVM compiler & runtime optimizations: caching, instruction fusion, constant hoisting, and correctness fixes (#626)

2026-03-23 21:00:51 -05:00