Re: Boost.URL: Something Wicked This Way Comes!

From: Phil Endecott (spam_from_boost_dev_at_[hidden])
Date: 2021-10-15 11:41:21

Robert Ramey wrote:
> On 10/13/21 7:09 AM, Phil Endecott via Boost wrote:
>> Back in 2005-ish I decided to write a URL parser based on the RFC BNF
>> using Boost.Spirit. At that time the most recent RFCs were RFC2616
>> (1999) and RFC2396 (1998). I did a fairly direct translation of the
>> BNF to Spirit and ... it didn't work. It turned out that the BNF in
>> the RFCs was wrong, and had been for 6 years at that point. So I
>> advise that you are careful about directly using the RFC BNF.
> ...
>
> Too me, all this argues for the usage of boost spirit as a url parser. 
> Maintenance, Verification, etc.  Of a protocol with the problems you 
> mention is much easier when the specification of the syntax is separated 
> from the code which does the parsing.

Spirit is also a backtracking parser, so can't promise
linear complexity - unless you can show that it does for
the particular grammar that you are using.

This isn't a performance issue, it's a security issue i.e.
you don't want your application to suffer denial of service
when it encounters malicious input.

Regards, Phil.