Watched word regular expression crash

AI-generated summary

A bug involving watched word regular expressions in Discourse causes 500 server errors when posts are made, particularly when invalid or previously valid regex patterns (like \-) are used. The issue stems from Unicode flag enforcement introduced in commit 9a27803, which now treats escapes like \- as invalid in Unicode mode. RGJ reported the problem, noting it breaks all watched words and affects even simple wildcards like *example*. nbianca confirmed the first part (server crash on invalid regex) is fixed, and is working on validating JS regexes from Ruby to resolve the second part. tumbano confirmed the issue affects wildcard patterns and workaround is removing all watched words. sam confirmed the team has prioritized the fix, with a PR merged to address the crash (#24163). Users are encouraged to check logs and provide watched word lists if issues persist. The bug impacts forums using watched words, especially after upgrading to 3.1.0+.

This is a twofold bug.

First, an error in a regular expression causes a 500 server error when any post is made.
See also this prior bug report Invalid regular expressions in 'Watched Words' makes no watched word work (scenario: worse).

Second, a previously correct regular expression which escapes a dash, is now seen as incorrect. So where \- used to work prior to 3.1.0 stable, it now causes a fatal error.

This is probably happening because of Unicode being enabled in 9a27803.

See Regular expression syntax cheat sheet - JavaScript | MDN

Note that some characters like :, -, @, etc. neither have a special meaning when escaped nor when unescaped. Escape sequences like \:, \-, \@ will be equivalent to their literal, unescaped character equivalents in regular expressions. However, in regular expressions with the unicode flag, these will cause an invalid identity escape error. This is done to ensure backward compatibility with existing code that uses new escape sequences like \p or \k.

but it would be nice if there was an exception handler here.

10 Likes

We have this prioritized now, will get to it in the next 4 weeks.

7 Likes

This has been fixed:

I am currently looking into finding a way to enable the validation of JS regular expressions from the Ruby side. I hope to have a fix ready soon.

6 Likes

I started getting error 500 on new posts since a recent update (last week). There were also errors related to emails (in sidekiq, it was watched words related). I only noticed this today. Tried to run an update but the error 500 when posting was still present. The only workaround I’ve found for now is to remove all watched word words.

I cannot reproduce it without any further information. Do you have watched_words_regular_expressions site setting enabled? Can you upload your list of watched words so I can test? Or maybe check your logs (https://your-forum/logs) and post here stack traces that are related to watched words.

Do you have watched_words_regular_expressions site setting enabled? → No

Did a few tests, it only seems to happen with *wildcards

asteriskexampleasterisk → this gives 500 error
example → is replaced correctly

asterisk is *

@RGJ do you feel the OP has been addressed

We merged this PR

https://github.com/discourse/discourse/pull/24163

2 Likes