s/// doesn't support regex

[lf-]

s/// doesn't support regex. It should.

Test:

(test(
s/($/)/
s/./

Expected output:

(test)

Actual output:

Bot doesn't seem to be triggered...

Did not find . in any recent messages.

[daboross]

AFAIK this was removed because of security vulnerabilities with allowing anyone to specify any regex. See #99.

[lf-]

That seems correct. Abra rewrote it and it appears to no longer be vulnerable, so this can be fixed.

[lethargilistic]

I noticed that the bot doesn't support regex today and started tinkering with it before checking the issues. I've pushed my work adding regex back in to my fork.

I've tested it against the malicious example in #99 and the examples in the article linked from there. It doesn't hang at all. Though, in the longer malicious examples from the article, it didn't replace, either. I suspect python's re package itself has been updated to sanitize that kind of input.