HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
google
re2
C++2015–2024
google / re2

re2

RE2 is a fast, safe, thread-friendly alternative to backtracking regular expression engines like those used in PCRE, Perl, and Python. It is a C++ library.

41Distinct people
51Mentions
0Explicit recommenders
9.8KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

RE2 is a fast, safe, thread-friendly alternative to backtracking regular expression engines like those used in PCRE, Perl, and Python. It is a C++ library.

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

Mentioned in the same Hacker News threads. That is not proof they are substitutes.

This week on Hacker News

Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 12:45:45 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year51 dated mentions

Observed mentions: 2015-06-04 18:22:57 UTC to 2024-09-05 13:58:02 UTC.

02468102015-01-01 00:00:00 UTC to 2016-01-01 00:00:00 UTC (exclusive): 6 mentions; 1 submissions, 5 comments20152016-01-01 00:00:00 UTC to 2017-01-01 00:00:00 UTC (exclusive): 6 mentions; 1 submissions, 5 comments2017-01-01 00:00:00 UTC to 2018-01-01 00:00:00 UTC (exclusive): 3 mentions; 0 submissions, 3 comments2018-01-01 00:00:00 UTC to 2019-01-01 00:00:00 UTC (exclusive): 4 mentions; 0 submissions, 4 comments2019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 9 mentions; 2 submissions, 7 comments20192020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 8 mentions; 1 submissions, 7 comments2021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 6 mentions; 1 submissions, 5 comments2023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 3 mentions; 0 submissions, 3 comments2024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 4 mentions; 1 submissions, 3 comments2024

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20152015-01-01 00:00:00 UTC2016-01-01 00:00:00 UTC615
20162016-01-01 00:00:00 UTC2017-01-01 00:00:00 UTC615
20172017-01-01 00:00:00 UTC2018-01-01 00:00:00 UTC303
20182018-01-01 00:00:00 UTC2019-01-01 00:00:00 UTC404
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC927
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC817
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC202
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC615
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC303
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC413

From the project README

An excerpt from the repository, fetched Nov 13, 2026.

Read the project’s introduction
RE2, a regular expression library RE2 is an efficient, principled regular expression library that has been used in production at Google and many other places since 2006. Safety is RE2's primary goal. RE2 was designed and implemented with an explicit goal of being able to handle regular expressions from untrusted users without risk. One of its primary guarantees is that the match time is linear in the length of the input string. It was also written with production concerns in mind: the parser, the compiler and the execution engines limit their memory usage by working within a configurable budget—failing gracefully when exhausted—and they avoid stack overflow by eschewing recursion. It is not a goal to be faster than all other engines under all circumstances. Although RE2 guarantees a running time that is asymptotically linear in the length of the input, more complex expressions may incur larger constant factors; longer expressions increase the overhead required to handle those expressions safely. In a sense, RE2 is pessimistic where a backtracking engine is optimistic: A backtracking engine tests each alternative sequentially, making it fast when the first alternative is common. By contrast RE2 evaluates all alternatives in parallel, avoiding the performance penalty for the last alternative, at the cost of some overhead. This pessimism is what makes RE2 secure. It is also not a goal to implement all of the features offered by Perl, PCRE and other engines. As a matter of principle, RE2 does not support constructs for which only backtracking solutions are known to exist. Thus, backreferences and look-around assertions are not supported. For more information, please refer to Russ Cox's articles on regular expression theory and practice: Regular Expression Matching Can Be Simple And Fast Regular Expression Matching: the Virtual Machine Approach Regular Expression Matching in the Wild Syntax In POSIX mode, RE2 accepts standard POSIX (egrep) syntax regular expressions. In Perl mode, RE2 accepts most Perl operators. The only excluded ones are those that require backtracking (and its potential for exponential runtime) to implement. These include backreferences (submatching is still okay) and generalized assertions. The Syntax wiki page documents the supported Perl-mode syntax in detail. The default is Perl mode. C++ API RE2's native language is C++, although there are ports and wrappers listed below. Matching Interface There are two basic operators: RE2::FullMatch requires the regexp to match the entire input text, and RE2::PartialMatch looks for a match for a substring of the input text, returning the leftmost-longest match in POSIX mode and the same match that Perl would have chosen in Perl mode. Examples: assert(RE2::FullMatch("hello", "h.*o")) assert(!RE2::FullMatch("hello", "e")) assert(RE2::PartialMatch("hello", "h.*o")) assert(RE2::PartialMatch("hello", "e")) Submatch Extraction Both matching functions take additional arguments in which submatches will be stored. The argument can be a string*, or an integer type, or the type absl::string_view*. (The absl::string_view type is very similar to the std::string_view type, but for historical reasons, RE2 uses the former.) A string_view is a pointer to the original input text, along with a count. It behaves like a string but doesn't carry its own storage. Like when using a pointer, when using a string_view you must be careful not to use it once the original text has been deleted or gone out of scope. Examples: // Successful parsing. int i; string s; assert(RE2::FullMatch("ruby:1234", "(\\w+):(\\d+)", &s, &i)); assert(s == "ruby"); assert(i == 1234); // Fails: "ruby" cannot be parsed as an integer. assert(!RE2::FullMatch("ruby", "(.+)", &i)); // Success; does not extract the number. assert(RE2::FullMatch("ruby:1234", "(\\w+):(\\d+)", &s)); // Success; skips NULL argument. assert(RE2::FullMatch("ruby:1234", "(\\w+):(\\d+)", (void*)NULL, &i)); // Fails: integer overflow keeps value from being stored in i. assert(!RE2::FullMatch("ruby:123456789123", "(\\w+):(\\d+)", &s, &i)); Pre-Compiled Regular Expressions The examples above all recompile the regular expression on each call. Instead, you can compile it once to an RE2 object and reuse that object for each call. Example: RE2 re("(\\w+):(\\d+)"); assert(re.ok()); // compiled; if not, see re.error(); assert(RE2::FullMatch("ruby:1234", re, &s, &i)); assert(RE2::FullMatch("ruby:1234", re, &s)); assert(RE2::FullMatch("ruby:1234", re, (void*)NULL, &i)); assert(!RE2::FullMatch("ruby:123456789123", re, &s, &i)); Options The constructor takes an optional second argument that can be used to change RE2's default options. For example, RE2::Quiet silences the error messages that are usually printed when a regular expression fails to parse: RE2 re("(ab", RE2::Quiet); // don't write to stderr for parser failure assert(!re.ok()); // can check re.error() for details Other useful predefined options are Latin1 (disable UTF-8) and POSIX (use POSIX syntax and leftmost longest matching). You can also declare your own RE2::Options object and then configure it as you like. See the header for the full set of options. Unicode Normalization RE2 operates on Unicode code points: it makes no attempt at normalization. For example, the regular expression /ü/ (U+00FC, u with diaeresis) does not match the input "ü" (U+0075 U+0308, u followed by combining diaeresis). Normalization is a long, involved topic. The simplest solution, if you need such matches, is to normalize both the regular expressions and the input in a preprocessing step before using RE2. For more details on the general topic, see https://www.unicode.org/reports/tr15/. Additional Tips and Tricks For advanced usage, like constructing your own argument lists, or using RE2 as a lexer, or parsing hex, octal, and C-radix numbers, see re2.h. Installation RE2 can be built and installed using GNU make, CMake, or Bazel. The simplest installation instructions are:
Read the full README on GitHub

What Hacker News says

9 sources
>As for disabling asserts in the code you ship: That is such a quaint 1980'ies thing to do, and people should have stopped doing it long time ago. Sqlite makes all its asserts noop in release mode[1]. Chrome disables DCHECK() in release mode[2], and it's used many times[3]. RE2 has debug only checking[4]. In Rust debug mode, signed integer overflow panics, in release mode it wraps[5]. Firefox disables MOZ_ASSERT() in release mode[6], and it's used many times[7]. I doubt Huawei is more modern and less 1980s than all these other projects. >My money is on Huaweis function doing the check with an assert which was compiled out for deliverable code. Are you saying it was compiled out because asserts were disabled, or because the compiler could reason about the arguments at every callsite? It seems unlikely to me that the compiler could reason a
Read the rest
In Report on the technical vulnerabilities found in Huawei 5G [pdf]
You probably want a regex engine that runs in linear time: * Google's RE2 https://github.com/google/re2/wiki/WhyRE2 * https://github.com/laurikari/tre/ There is a good series of articles about the problem: https://swtch.com/~rsc/regexp/regexp3.html I would strongly recommend deploying such a regular expression matcher to avoid problems like this. There are examples in the above article that you can use to test anything in your production deployment that accepts regular expressions to see how well it copes.
In Cloudflare outage caused by bad software deploy
RE2 was used in Google Code Search in an adversarial context, and it handles the DFA issue by simply putting an 8MB limit on the DFA for a regex: https://github.com/google/re2/blob/master/re2/re2.h#L601 I learned a few months ago that Rust's regex crate, which is based heavily on RE2, does the same thing. There is perhaps something worth exploring there, but after reading the Cox articles, I can see that there are so many issues that come up in regex implementation, and this seems to be one of the smaller ones. I don't think the "regex as untrusted data" use case is very common. That is, there are probably 10,000 programs that use regexes for every one that accepts regexes from users. ----- Although, one thing I've wanted to explore is Regex derivatives. Supposedly that technique constructs an optimal DFA directly. You don't have to ma
Read the rest
ke an NFA, convert it to a DFA, and then optimize the DFA. Cox describes it as a "win-win" here (in contrast to parsing with derivatives, which is asymptotically worse than traditional parsing algorithms) https://research.swtch.com/yaccalive There a bunch of non-production implementations floating around like https://github.com/google/redgrep https://github.com/MichaelPaddon/epsilon (This technique was revived by the 2009 paper cited) ----- Regarding the blog post, I have some material here. I gave about 10% of this as a 5-minute talk, and realized it's about 2 hours worth of material. https://www.oilshell.org/share/05-31-pres.html I still think the table toward the end is a good summary and perhaps worth publishing with some more context / explanation. ---- One interesting test of whether the message from Cox's articles got through is what style of regex engine newer languages are using. I just noticed Julia uses PCRE, which is unfortunate IMO. I like RE2 -- it has a nice API, great performance, and a lot of features. https://docs.julialang.org/en/v1/manual/strings/index.html#R... Swift also has Perl-style regexes, but maybe they inherited it from Objective C: https://developer.apple.com/documentation/foundation/nsregul... So basically Rust is the only newer language that appears to have gotten the message. The Oil shell will of course use "regular languages" rather than regexes, but that's natural because shell never had Perl-style regexes. One thing I think Cox didn't explore enough is that most libc's appear to be using the "fast" good method, because they don't need Perl constructs. I guess that would be a good follow-up article. To test GNU libc and musl libc on those pathological cases. I looked at their code a few years ago and they looked "right" (I've forgotten the details), but I don't think I ever did the test.
In Regular Expression Matching Can Be Simple and Fast (2007)

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.