Module regex_util 

Bounded compilation of untrusted regular expressions.

Per CLAUDE.md §Regex Compilation, any regex::Regex whose pattern originates outside the binary (config file, CLI flag, TUI input, HTTP payload, message queue) must be compiled through compile_bounded, which caps compile-time memory and rejects over-long patterns. Literal, build-time patterns may use regex::Regex::new directly (optionally once_cell::sync::Lazy<Regex>).

Unlike GTB’s Go counterpart, no match-time timeout is needed: Rust’s regex is a Thompson NFA with linear-time matching, so there is no catastrophic-backtracking class to defend against. The caps bound compile-time memory — the only remaining denial-of-service vector.

See docs/development/specs/2026-06-26-rtb-app-regex-util-compile-bounded.md.

Enums

RegexCompileError

Error returned when an untrusted pattern is rejected or fails to compile within the configured memory bounds.

Constants

DFA_SIZE_LIMIT

RegexBuilder::dfa_size_limit — lazy-DFA cache cap.

MAX_PATTERN_LEN

Maximum byte length of an externally-sourced pattern.

SIZE_LIMIT

RegexBuilder::size_limit — compiled-program memory cap.

Functions

compile_bounded

Compile an untrusted pattern under fixed memory bounds.