Case study: Cloudflare outage
In July 2019, a poorly formed regex in Cloudflare's firewall rules caused CPU usage to spike and websites to come crashing down worldwide. The cause? This regex:
(?:(?:\"|'|\]|\}|\\|\d|(?:nan|infinity|true|false|null|undefined|symbol|math)|\`|\-|\+)+[)]*;?((?:\s|-|~|!|{}|\|\||\+)*.*(?:.*=.*)))
- Regex engines perform backtracking to check for multiple match possibilities
- This particular string led to catastrophic backtracking
- Moral of the story: test carefully, both positive and negative