The postmortem for the recent Stack Overflow outage implicates a backtracking implementation of regular expression matching in the outage.
O(N) implementations of regex matching that don't require backtracking exist -- see Russ Cox's paper Regular Expression Matching Can Be Simple And Fast for more background. The RE2 library for example is open source, and it seems like it should be possible to use from the Stack Overflow stack, although it is written in C++.
Are there technical reasons why Stack Overflow uses a backtracking regex library, or is it simply a case of using the simplest thing that worked since it never was a problem before? I'm surprised that switching to a different regex implementation (or even a custom non-regex DFA sanitizer) isn't one of the follow-up actions listed in the postmortem.
^\s+|\s+$
becomes^\s+
and\s+$
.^[\s\u200c]+|[\s\u200c]+$
> Some people, when confronted with a problem, think “I know, I'll use regular expressions.” Now they have two problems.