Runtime: Add a static property Regex.DefaultRegexMatchTimeout to configure default timeouts globally

[NickCraver]

System.Text.RegularExpressions.Regex has a .MatchTimeout property, but there has never been a good way to configure this globally. It's always been a very roundabout way (which AFAIK has been removed in .NET Core). Previously, you'd do this:
```c#
AppDomain.CurrentDomain.SetData("REGEX_DEFAULT_MATCH_TIMEOUT", TimeSpan.FromSeconds(20));

Or in ASP.NET:
```xml
<system.web>
  <httpRuntime defaultRegexMatchTimeout="00:00:20" />
</system.web>

Otherwise, we're depending on every developer to set their match timeouts inline, for each regex. The problems with that are:

• It's either a maintenance burden, or we create our own global config anyway to use everywhere.
• It defaults to failure if the developer forgets (creating a security and stability issue, since regexes can be a CPU-killing attack vector)

If we had a static property, like this:
c# namespace System.Text.RegularExpressions { public partial class Regex { // Set a default value, to be used if not overridden. public static TimeSpan DefaultMatchTimeout = Timeout.InfiniteTimeSpan; } }
...we could do this gracefully in code. Thoughts?

cc @terrajobst @blowdart @davidfowl

[edited by @Priya91 for syntax]

[terrajobst]

@weshaggard, given the AppDomain type is coming back the .NET Framework way:

C# AppDomain.CurrentDomain.SetData("REGEX_DEFAULT_MATCH_TIMEOUT", TimeSpan.FromSeconds(20));

should still work.

@NickCraver @blowdart assuming that's true, would do you still think the global property is useful? Personally, I think it would be good to have the property and implement it by reading/storing the AppDomain data for consistency. However, I think we can agree that if the global time out via AppDomain works, it's less critical.

[blowdart]

Well you'd still have to wire it in. But that app domain setting was so poorly documented and hard to find. A property would at least expose this better.

[NickCraver]

Agreed on something more intuitive and discoverable being available. The lack of people setting this easily takes down production systems. Given the nature of what it prevents, it should be something as easy to access as possible.

[weshaggard]

I agree we probably should have a public property for this setting.

[karelz]

Any proposals for property name & which class to be on? (AppDomain?)

[terrajobst]

Any proposals for property name & which class to be on?

It's in the proposal 😄

[karelz]

Hmm, bad skimming on my side, sorry :)

[danmosemsft]

@Priya91 I believe you own Regexes. Do you consider tihs ready for api review? if so please flip labels.

[Priya91]

@danmosemsft The ask sounds reasonable, the issue doesn't exactly have the proper API syntax though. Updated the issue with API syntax.

cc @ViktorHofer

[terrajobst]

We decided that we don't want a static API on Regex as this design would allow the default to change over the lifetime of the app. Rather, we'd like the value to be init only, akin to what AppDomain.SetData enforces today. Thus, we'll make the SetData API work and not expose the API.

[karelz]

We should verify with ASP.NET Core team, that there is a way for ASP.NET Core to all SetData prior to executing any code which uses RegEx - either from main by user, or via config to hosting.

[karelz]

FYI: The API review discussion was recorded - see https://youtu.be/VppFZYG-9cA?t=789 (14 min duration)

[danmosemsft]

@ViktorHofer did we find out whether this is going to work for ASP.NET Core apps? ie does user code get to run early enough

[ViktorHofer]

Yes, you can set the timeout in the AppDomain data container before bootstrapping the WebHost: https://github.com/benaadams/Ben.Samples/blob/master/SmallHelloWorld/Program.cs#L7

[karelz]

We should make sure it is guarantee ASP.NET Core is aware of and that they have a test for it to make sure it does not regress. Can you please work with them?

[ViktorHofer]

@karelz sorry my late response. Yes I will talk to them.

[karelz]

Thanks! Please loop me in, when we manage to create an issue to add a regression test for this scenario.

[Eilon]

ASP.NET Core applications are regular console applications, with a regular Program.Main. As such, it’s certainly possible for an ASP.NET Core app to run all kinds of logic (including using regex) prior to ASP.NET Core starting up.

[karelz]

I assume that also means that the app has an option to change default RegEx setting prior to any other code runs. We are good then, the developer is empowered to change the RegEx setting for his/her app.

[Eilon]

Yes it sounds that way.

[srutzky]

Hi there. I have a question that is very much related to this topic (i.e. globally setting REGEX_DEFAULT_MATCH_TIMEOUT). I realize that this is not exactly a Q & A platform, but I have searched quite a bit and have found nothing even remotely close to this specific issue. I also have a vague memory of posting this question on Stack Overflow a year or so ago, but it isn't there now and I was never notified that it got deleted so not sure if I was merely hallucinating ;-). If I could, at the very least, get pointed in the right direction, that would be very much appreciated.

The question: Is there a way, in regular 'ol .NET Framework ("Desktop", I believe), to set the App Domain value of REGEX_DEFAULT_MATCH_TIMEOUT in the app config file (similar to how this is done in ASP.NET)?

The situation: I'm working in a rather restrictive environment (CLR host):

1. It is Desktop .NET CLR 4.0
2. No option for .NET Core
3. It's not ASP.NET, so <httpRuntime defaultRegexMatchTimeout="00:00:20" /> in the config file is not an option
4. The code does _not_ have Full Trust, so AppDomain.CurrentDomain.SetData("REGEX_DEFAULT_MATCH_TIMEOUT", TimeSpan.FromSeconds(20)); is not an option
5. I cannot guarantee that the target system has .NET Framework version 4.5 or above; I only know that it has a 4.x version since it is using CLR 4.0. So, setting the MatchTimeout property isn't a reliable option.

Any ideas? At this point I do not believe that it's possible to do what I am wanting to do, but I figured I would ask first. Thanks and take care, Solomon..