Regular Expressions Module 11
Performance, ReDoS and security interview questions
Interview questions on performance, ReDoS and security: warm-ups, then what each harder question tests and how a good answer starts.
Warm-up questions
Short questions with short answers, each answered in full.
-
Mid to senior
How does a backtracking engine run a pattern, how does an automaton engine run it, and what is the worst case of each?
Answered in the lesson Backtracking engines versus automata engines
-
Fresher to mid
What are the four shapes that drive catastrophic backtracking, and what do all four have in common?
-
Fresher to mid
Two patterns accept and refuse exactly the same lines. What can still make one of them much slower?
Answered in the lesson Writing fast regexes and measuring them
-
Fresher to mid
Name the two ways untrusted regex reaches a service, and the defence that fits each.
Answered in the lesson Regex with untrusted patterns and input
-
Fresher to mid
What do you check first in a pattern you did not write, and why is one matching example not enough?
Answered in the lesson Reviewing regexes from forums or AI assistants
Questions with model answers
What each question tests, the first step of a good answer and the follow-ups to expect.
-
Senior to staff
An alerting service compiles 4,000 customer filters with RE2 at its default options and runs every log line through each of them. After a deploy its memory climbs for hours, then levels off far above what the compiled patterns should need. Explain what is growing, estimate the ceiling, and say what you would change.
- What it tests
- Knowing that RE2 builds DFA states lazily into a budget per object, multiplying that budget by the number of patterns, and choosing between smaller budgets, combined sets and a cheap first filter, with the cost of each.
- First step
- Split the memory into what is fixed once a pattern is compiled and what grows while lines arrive. Look up in RE2's own header which option bounds the growing part and what its default is, and ask what that bound applies to: one pattern, one object or the whole service. Then plan what to measure on a staging copy with real, varied lines.
- Follow-ups
-
- What happens to matching speed when you cut max_mem to a small fraction of the default?
- How would one RE2::Set of all the filters change the memory and the work per line?
- Why does the memory level off instead of growing for ever?
- Would a backtracking engine use less memory here, and what would that trade away?
From the lesson Backtracking engines versus automata engines
Model answer, Pro. Model answers open with any pass; prices are in the notice on this page.Opening the model answers with your pass…
Model answers open with any MySmartCoPilot pass.
- Pro pass · 1 week₹79$2.99
- 30 days₹179$5.99
- 1 year₹1,699$45
One payment; a pass never renews. The price shown is the total you pay: no fees or charges are added at checkout.
Passes can’t be bought right now, so the model answers can’t be opened at the moment. If you have a pass, enter your licence key.
It also opens every other in-depth part in Learn and every Pro tool. Sales are final, except where the law gives you a right to withdraw, for example in the EU and the UK (refund policy).
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 5 minutes
-
Mid to senior
Your payment router's CI runs recheck and ESLint's recommended rules, and it flagged all three new patterns: a nested quantifier, overlapping alternatives, and an end-anchored run. The service runs on Node.js 24 and the team wants to ship all three. Which, if any, do you block from merging, and what evidence goes in the pull request?
- What it tests
- Separating the three shapes by growth, picking the input size and the limit under which each becomes a problem, and giving the reader a decision rather than a lecture.
- First step
- Classify each report by its growth class with recheck's own output: exponential for the nested one and the overlapping one, polynomial for the end-anchored one. Then ask, for each, how long an input the service accepts and how long a worst-case match would take at that length under the pinned engine; the decision is about the input length the service accepts.
- Follow-ups
-
- The overlapping-alternatives pattern looks safe at ten characters. When does it stop being safe?
- Which of the three would you still block if the service used Rust's regex engine?
- How do you prove, in the pull request, that your fix works without printing a time?
- A fourth pattern uses a backreference and recheck says "unknown". How do you decide?
From the lesson Catastrophic backtracking and ReDoS
Model answer, Pro.In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 5 minutes
-
Mid to senior
A webhook validator in your team's Python 3.14 service takes over ninety seconds to answer once a day. It accepts posts up to 2 MB and runs three patterns on each. You want to reproduce the slow case on your laptop before changing anything. How do you reproduce it safely, and what evidence goes in the bug ticket?
- What it tests
- Reproducing a slow match without hanging a laptop, picking the right limit for the engine in question, and presenting a count or a verdict rather than a time.
- First step
- Pull a few of the posts that arrived just before each ninety-second answer and run each pattern against them under a per-call timeout from the third-party regex module (Python's standard re has none), or under pcre2test with a match limit if the patterns run on PCRE2. The limit answers the question without needing a hang.
- Follow-ups
-
- The service is deployed on Node.js, not Python. Which limit do you use there, and what does it tell you?
- A recheck run on the three patterns comes back safe for all three. Does that end the investigation?
- How do you turn the finding into a test that fails on the weak pattern and passes on the fix?
- Would you share the slow input in the ticket, and why?
From the lesson Catastrophic backtracking and ReDoS
Model answer, Pro.In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 5 minutes
-
Mid to senior
A nightly Python job reads 9 million lines of a delivery log through twelve patterns and has started to overrun its two-hour window. Your lead asks for all twelve to be rewritten with possessive quantifiers. How do you decide what to change, and what do you put in the pull request as evidence?
- What it tests
- Measuring before rewriting, telling the shape of a pattern apart from the cost of each call, keeping the answers identical, and reporting evidence that still holds on another machine.
- First step
- I would find out where the two hours go before changing a pattern: how many lines each pattern sees, how many of them it refuses, and which patterns the job spends its time in. A job that reads every line through twelve patterns usually has two separate problems, one pattern whose cost grows with the line and eleven that are simply called 9 million times, and the fixes for those are different.
- Follow-ups
-
- Which of the twelve would you expect the measurement to blame, and why?
- What do you change for a pattern that is merely called nine million times?
- How do you show in the pull request that no rewrite changed an answer?
- The job must also keep its old output for one release. How do you arrange that?
From the lesson Writing fast regexes and measuring them
Model answer, Pro.In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 6 minutes
-
Mid to staff
A PHP service matches support tickets with a rule that was tuned with possessive forms and measured with PCRE2's just-in-time compiler. The same rule now has to run in a Go worker and in a browser form. What carries over, what does not, and how would you show that the three agree?
- What it tests
- Knowing which tunings are engine-specific, that a faster engine changes a constant and not the growth, and how to prove three copies of one rule agree without relying on timings.
- First step
- I would separate the rule from its tuning. The accepted text is the product decision and has to be identical in three engines; the possessive forms and the just-in-time measurement are properties of one library. So my first move is to write the rule's accept-and-refuse table as the shared artefact, then ask what each engine needs to answer it, rather than porting the pattern text as it stands.
- Follow-ups
-
- Which parts of the tuned pattern will Go refuse, and what do you write instead?
- The browser copy is for a form. Does it need the same pattern at all?
- What measurement would you redo per engine, and what would you not bother repeating?
- How do you keep the three copies from drifting apart over a year?
From the lesson Writing fast regexes and measuring them
Model answer, Pro.In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 6 minutes
-
Senior to staff
A security-monitoring product runs customers' saved detection rules in a Node service on eight worker threads, stopping any match after 50 ms. One customer's rule hits the stop on 400 lines a second: every customer's alerts arrive minutes late, and the stopped lines raise no alert. What is wrong, and what do you change?
- What it tests
- Reasoning about what a deadline costs for every match it stops, sizing a worker pool from that cost, isolating one customer's rules from the others, and deciding what a stopped match should mean to a security product.
- First step
- Work out the capacity first: how many worker-seconds a second eight threads give, and how many one rule spends when every stopped match costs the full 50 ms. Then ask two questions of the design: whose lines wait while that rule runs, and what the service writes down when a match is stopped.
- Follow-ups
-
- How many workers would this one rule need, and why is adding them the wrong fix?
- How do you keep one customer's rules from delaying every other customer's alerts?
- What should the service record when a match is stopped, and who should hear about it?
- How would you prove the fix holds without asserting on milliseconds?
From the lesson Regex with untrusted patterns and input
Model answer, Pro.In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 5 minutes
-
Mid to senior
A Python importer splits each row of a supplier's CSV with
,(?=(?:[^"]*"[^"]*")*[^"]*$)to find the commas outside quotes, then caps every cell at 256 characters. One supplier's 5 MB export arrives as a single line, and the import worker runs for many minutes. Why, and how do you make the importer safe?- What it tests
- Recognising the user-input case, estimating the work a lookahead does on a long line, placing a length cap where it bounds that work, and choosing between a pattern and a parser for a file format.
- First step
- Name the threat case first: the pattern is yours and the file is the untrusted input. Then work out what the lookahead reads from each comma it tries, how many commas a 5 MB line can hold, and which unit the 256-character cap actually limits.
- Follow-ups
-
- How much work does the split do on an ordinary 200-character row, and on the 5 MB line?
- Why did the 256-character cell cap not help, and where should the cap go?
- What does Python's csv module change, and which of its limits do you set?
- How do you keep the 5 MB line as a test without asserting on time?
From the lesson Regex with untrusted patterns and input
Model answer, Pro.In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 5 minutes
-
Mid to senior
A warehouse team asks you to review a pattern that will run inside a label printer's firmware, whose regex engine you cannot install or run anywhere. The vendor's manual lists its syntax in two pages. How do you review the pattern, and what do you hand back to the team?
- What it tests
- Whether a candidate can review without a run: reading a syntax list for refusals and for quiet differences, writing a table the other engine will decide later, and naming what stays unproven.
- First step
- I read the vendor's two pages and mark every construct the pattern uses against them, sorting the list into refused, present with the same meaning, and present with a different meaning. Then I write the test table from the rule in words, so the team can run it on the printer once and send the answers back. I hand over that table and a list of the rows nobody has settled yet, not a verdict.
- Follow-ups
-
- Which parts of the pattern can you settle from the manual alone?
- What goes in the table when the manual says nothing about a construct?
- The team runs the table and two rows disagree with what you expected. What do you do next?
- How do you keep the pattern and its table in step when the firmware is updated?
From the lesson Reviewing regexes from forums or AI assistants
Model answer, Pro.In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 6 minutes
-
Mid to staff
A validator has been in production for two quarters, and your review finds that it over-accepts: it allows values the stated rule forbids, and about 300 stored rows match only the loose pattern. Tightening the pattern is a one-line change. What else does the change need, and in what order?
- What it tests
- Whether a candidate treats an over-accepting validator as a data problem as well as a pattern problem, orders the repair and the clean-up, and keeps both rules runnable while the two disagree.
- First step
- Before touching the pattern I run both rules over the stored rows and count the disagreements, because that number decides the order of the work. The strict pattern on its own would start refusing edits to rows that already exist, so the clean-up of those values is planned first, with the loose rule kept beside the strict one for as long as both are true of the data.
- Follow-ups
-
- How do you measure the damage before you change anything?
- What happens to the rows that only the loose pattern accepts?
- Where does the strict rule go first, and why not everywhere at once?
- What does the test table look like while both rules are live?
From the lesson Reviewing regexes from forums or AI assistants
Model answer, Pro.In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 6 minutes
All Regular Expressions interview questions · The Regular Expressions track