Dev Tools · 10h ago
Dart ReDoS risk: new RE2 binding prevents regex hangs
Dart's built-in RegExp engine can be exploited via ReDoS, taking seconds to reject crafted inputs. A new FFI package binds Google's linear-time RE2 library, cutting matching time from seconds to microseconds. The package offers a drop-in replacement for RegExp with a dispose method.
Meridian48 take
The SDK team's decision not to fix the backtracking engine puts the onus on developers to proactively swap in RE2 for user-facing regex.
dartregex-security