Heads up: max_program_size deprecation will require re2j changes to allow validation

[ejona86]

This is just documenting the information that may be necessary if java-control-plane wants to start validating regular expression max_program_sizes. This is unnecessary if the regular expressions are considered "trusted" (known to be non-malicious).

I had this information and wanted to dump it somewhere that it may be useful if the need arises. It seems there is no explicit management of GoogleRE2 in this repo. Feel free to close.

---

In envoyproxy/envoy#10971, Envoy deprecated the max_program_size configuration field in favor of the control plane being responsible. This is great, and works for C++ and Go languages, but leaves some TODOs for Java.

The C++ re2 exposes RE2::ProgramSize() which reports the number of instructions of the compiled regular expression. This is the "program size" that Envoy was referring to.

Go's regexp/syntax package allows getting something similar:

regex, err := syntax.Parse("INPUT HERE", 0)
prog, err := syntax.Compile(regex)
len(prog.Inst) // this is the program size

But it does not appear re2j supports such a feature. Basically, you will need a new Pattern method that returns the length of Prog.inst (via re2.prog).