# Сancelable/async regexp
**URL:** https://es.discourse.group/t/ancelable-async-regexp/225
**Category:** đź’ˇ Ideas
**Created:** [February 16, 2020, 9:38am UTC](https://es.discourse.group/t/ancelable-async-regexp/225 "2020-02-16T09:38:43Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@nskulikov](https://es.discourse.group/u/nskulikov)
#### Post date: [February 16, 2020, 9:38am UTC](https://es.discourse.group/t/ancelable-async-regexp/225/1 "2020-02-16T09:38:43Z")
Regular expressions have exponential time worst case complexity and its usage are blocking operations. This provides the ability of ReDoS attack.
```javascript
time node -e '/A(B|C+)+D/.test("ACCCCCCCCCCCCCCCCCCCCCCCCCCX")'
// real 0.529s
time node -e '/A(B|C+)+D/.test("ACCCCCCCCCCCCCCCCCCCCCCCCCCCCCX")'
// real 3.809s
```
My suggestion is to make regexp asynchronous and cancellable. This will allow us to reliably protect ourselves from such attacks in production, because we always (almost) know how complex the string is expected to be for a given matcher, and the other cases are most likely an attack and do not need to check them.
---
### Author:  [@nskulikov](https://es.discourse.group/u/nskulikov)
#### Post date: [February 16, 2020, 10:10am UTC](https://es.discourse.group/t/ancelable-async-regexp/225/2 "2020-02-16T10:10:22Z")
Possible usage like this:
```javascript
...
/regex/.test("string", 100) // Operations more than 100ms returns false
...
```
or:
```javascript
/regex/.test("string", 100) // Operations more than 100ms throws error
.catch(() => false)
```
maybe even:
```javascript
function check(str) {
const re = new RegExp('regex');
return new Promise(function (resolve, reject) {
re.onDone(resolve);
re.onCancel(reject);
setTimeout(function () {
re.cancel();
}, 100);
re.test(str)
});
}
```
---
### Author:  [@pygy](https://es.discourse.group/u/pygy)
#### Post date: [February 16, 2020, 7:36pm UTC](https://es.discourse.group/t/ancelable-async-regexp/225/3 "2020-02-16T19:36:49Z")
I agree that with thier current semantics, RegExps are not safe to use in production. I proposed an [alternative](https://es.discourse.group/t/possessive-regexp-matching/203/10) recently that got support from @jridgewell, but didn't get any traction with implementers (the Chrome and Safari team).
They are instead working on preventing backtracking when possible.
I don't think it is the safest way forward though. Either what you propose or possessive RegExps give the ultimate power to users and both options can be tested exhaustively.
OTOH, engine optimizations can fail or regress in corner cases that escape testing.
---
### Author:  [@nskulikov](https://es.discourse.group/u/nskulikov)
#### Post date: [February 26, 2020, 8:30am UTC](https://es.discourse.group/t/ancelable-async-regexp/225/4 "2020-02-26T08:30:15Z")
I just want to have possibility to avoid event loop blocking, besides it doesn't contradicts to yours proposal :)
---
### Author:  [@pygy](https://es.discourse.group/u/pygy)
#### Post date: [February 28, 2020, 3:18pm UTC](https://es.discourse.group/t/ancelable-async-regexp/225/5 "2020-02-28T15:18:56Z")
Indeed, I wanted to give you what seems like relevant information on the topic
---
### Author:  [@cs32](https://es.discourse.group/u/cs32)
#### Post date: [November 14, 2025, 3:19am UTC](https://es.discourse.group/t/ancelable-async-regexp/225/6 "2025-11-14T03:19:42Z")
@nskulikov, this is actually already possible in javascript in both browsers and node.js.
In the browser, we have web workers. And in node.js, we have the `Worker` class from the `node:worker_threads` package. I had to implement a worker thread for running a regex test server-side for a project where I knew the regex was susceptibly sourced from user input. I just used a worker, and passed the regex and test string. I then even terminated it after 5 seconds if it didn’t complete by then (probably longer than needed, but I can always tweak it).