Restore regex_remap's default PCRE2 match limit

plugins/esi/lib/IncludeUrlValidator.cc

@@ -39,7 +39,6 @@ namespace
   // Backtracking limit for the allowlist match. PCRE2 stops and reports
   // PCRE2_ERROR_MATCHLIMIT once this many match steps are taken, bounding
   // worst-case CPU per validation against attacker-influenced hostnames.
-  // Matches the value used by the regex_remap plugin.
   constexpr uint32_t ALLOW_REGEX_MATCH_LIMIT = 1750;
 
   bool

plugins/regex_remap/regex_remap.cc

@@ -55,9 +55,8 @@
 static const char *PLUGIN_NAME = "regex_remap";
 
 // Constants
-static const int     MATCHCOUNT        = 15;   // We support $0 - $9 x2 ints, and this needs to be 1.5x that
-static const int     MAX_SUBS          = 32;   // No more than 32 substitution variables in the subst string
-static const int32_t REGEX_MATCH_LIMIT = 1750; // POOMA - also dependent on actual stack size. Crashes with previous value of 2047
+static const int MATCHCOUNT = 15; // We support $0 - $9 x2 ints, and this needs to be 1.5x that
+static const int MAX_SUBS   = 32; // No more than 32 substitution variables in the subst string
 
 // Substitutions other than regex matches
 enum ExtraSubstitutions {
@@ -917,7 +916,6 @@ TSRemapNewInstance(int argc, char *argv[], void **ih, char * /* errbuf ATS_UNUSE
   if (!ri->rule_set) {
     return TS_ERROR;
   }
-  ri->match_context.set_match_limit(REGEX_MATCH_LIMIT);
   if (ri->profile) {
     ri->rule_hits.resize(ri->rule_set->rules().size());
   }

tests/gold_tests/pluginTest/regex_remap/long_query.conf

@@ -0,0 +1,20 @@
+#  Licensed to the Apache Software Foundation (ASF) under one
+#  or more contributor license agreements.  See the NOTICE file
+#  distributed with this work for additional information
+#  regarding copyright ownership.  The ASF licenses this file
+#  to you under the Apache License, Version 2.0 (the
+#  "License"); you may not use this file except in compliance
+#  with the License.  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+
+# Match a token within the query and preserve both capture groups.
+^/cms(\?.*)TOKEN(.*)$ https://redirect.example/cms$1TOKEN$2 @status=302
+# Make a skipped rule observable without contacting an origin.
+^/cms.*$ https://fallback.example/ @status=307

tests/gold_tests/pluginTest/regex_remap/regex_remap.test.py

@@ -45,6 +45,13 @@
 # Define ATS and configure
 ts = Test.MakeATSProcess("ts", enable_cache=False)
 
+# These two rules deliberately exercise resource limits. Replace the blanket
+# error exclusion once, then append independent checks for each rule below.
+ts.Disk.diags_log.Content = Testers.ExcludesExpression(
+    r'ERROR: (?!\[regex_remap\] Bad regular expression result '
+    r'(?:-(?:46|47|53|63) .* from "\^/alpha/bravo/|-47 .* from "\^/match_limit/))',
+    "Only the deliberate resource-limit errors are allowed")
+
 testName = "regex_remap"
 
 regex_remap_conf_path = os.path.join(ts.Variables.CONFIGDIR, 'regex_remap.conf')
@@ -116,26 +123,29 @@
 tr.Processes.Default.Streams.stdout = "gold/regex_remap_simple.gold"
 tr.StillRunningAfter = ts
 
-# 3 Test - Match limit test 0
-tr = Test.AddTestRun("match limit 0")
+# 3 Test - Preserve the original crash guard from #5762. This request must
+# survive resource exhaustion without redirecting, regardless of which matching
+# resource limit is reached (JIT stack, match work, depth, or heap).
+tr = Test.AddTestRun("resource exhaustion does not crash ATS")
 creq = replay_txns[1]['client-request']
-tr.MakeCurlCommand(curl_and_args + \
-    '--header "uuid: {}" '.format(creq["headers"]["fields"][1][1]) + '"{}"'.format(creq["url"]), ts=ts)
+tr.MakeCurlCommand(curl_and_args + f"--header 'uuid: {creq['headers']['fields'][1][1]}' '{creq['url']}'", ts=ts)
 tr.Processes.Default.ReturnCode = 0
 tr.Processes.Default.Streams.stdout = "gold/regex_remap_crash.gold"
-ts.Disk.diags_log.Content = Testers.ContainsExpression(
-    'ERROR: .regex_remap. Bad regular expression result -47', "Match limit exceeded")
+ts.Disk.diags_log.Content += Testers.ContainsExpression(
+    r'ERROR: \[regex_remap\] Bad regular expression result -(?:46|47|53|63).*"\^/alpha/bravo/',
+    "The crash-guard rule must report resource exhaustion")
 tr.StillRunningAfter = ts
 
-# 4 Test - Match limit test 1
-tr = Test.AddTestRun("match limit 1")
+# 4 Test - The nested quantifiers must exceed PCRE2's default matching-work limit.
+tr = Test.AddTestRun("excessive backtracking reaches the match limit")
 creq = replay_txns[2]['client-request']
 tr.MakeCurlCommand(curl_and_args + \
     '--header "uuid: {}" '.format(creq["headers"]["fields"][1][1]) + '"{}"'.format(creq["url"]), ts=ts)
 tr.Processes.Default.ReturnCode = 0
 tr.Processes.Default.Streams.stdout = "gold/regex_remap_crash.gold"
-ts.Disk.diags_log.Content = Testers.ContainsExpression(
-    'ERROR: .regex_remap. Bad regular expression result -47', "Match limit exceeded")
+ts.Disk.diags_log.Content += Testers.ContainsExpression(
+    r'ERROR: \[regex_remap\] Bad regular expression result -47.*\^/match_limit/',
+    "The excessive-backtracking rule must reach the match limit")
 tr.StillRunningAfter = ts
 
 

tests/gold_tests/pluginTest/regex_remap/regex_remap_long_query.test.py

@@ -0,0 +1,19 @@
+#  Licensed to the Apache Software Foundation (ASF) under one
+#  or more contributor license agreements.  See the NOTICE file
+#  distributed with this work for additional information
+#  regarding copyright ownership.  The ASF licenses this file
+#  to you under the Apache License, Version 2.0 (the
+#  "License"); you may not use this file except in compliance
+#  with the License.  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+
+Test.Summary = 'Verify regex_remap redirects with long query strings.'
+Test.SkipUnless(Condition.PluginExists('regex_remap.so'))
+Test.ATSReplayTest(replay_file='replay/long_query.replay.yaml')