re2

google-re2 is the official Python wrapper around RE2, Google’s regular expression library used internally to safely evaluate patterns against untrusted input. Where Python’s built-in re module relies on backtracking and can be driven into catastrophic, exponential-time blowups by certain patterns (ReDoS), RE2 guarantees linear-time matching by evaluating all alternatives in parallel rather than testing them one at a time. The trade-off is a deliberately restricted feature set: backreferences and look-around assertions aren’t supported, because no non-backtracking implementation of them exists.

The Python package mirrors the re module’s API closely: search, match, fullmatch, finditer, findall, split, sub, and subn all work the same way, so it’s usually a near drop-in replacement for code that needs the safety guarantee. Under the hood it’s a pybind11 extension over the C++ RE2 library, with a compiled-pattern LRU cache and careful UTF-8 byte-offset-to-character-offset translation so results line up with Python’s str semantics rather than raw byte spans.

What You Get

• Linear-time matching guarantee — RE2 evaluates regex alternatives without backtracking, so match time scales with input length regardless of pattern complexity.
• A familiar re-like API — search, match, fullmatch, finditer, findall, split, sub, and subn behave like their re module counterparts.
• An Options class for tuning RE2 behavior — encoding (UTF-8 or Latin-1), POSIX vs Perl syntax, longest-match semantics, memory budget, and more.
• A compiled-pattern LRU cache (128 entries by default) so repeated compile() calls on the same pattern and options don’t recompile from scratch.

Common Use Cases

• Sanitizing or matching regex patterns supplied by untrusted users (e.g. search filters, validation rules) without risking a ReDoS-driven denial of service.
• Processing large volumes of text (logs, scraped HTML, user input) where predictable matching performance matters more than PCRE-specific syntax.
• Replacing re in security-sensitive services where a single crafted pattern must never be able to hang a worker process.
• Validating regex-based configuration (e.g. routing rules, feature flags) at request time in a multi-tenant system.

Under The Hood

Architecture The Python package (python/re2.py, python/_re2.cc) is a thin pybind11 layer over the core C++ engine in re2/re2.h and re2/re2.cc, which in turn dispatches to one of several execution engines — a DFA (re2/dfa.cc), an NFA (re2/nfa.cc), a one-pass matcher (re2/onepass.cc), and a bitstate backtracker for small inputs (re2/bitstate.cc) — chosen automatically based on the compiled pattern and input size, all sharing the same compiled program representation from re2/compile.cc and re2/prog.h. The Python _Regexp class wraps a compiled _re2.RE2 object behind an lru_cache-backed _make() factory, and its _match() generator does the work of converting Python str offsets to UTF-8 byte offsets before calling into the C++ matcher and converting spans back, which is the main piece of Python-side complexity in an otherwise straightforward binding.

Tech Stack Core RE2 is C++17, built via GNU Make, CMake, or Bazel, and depends on Abseil (absl/strings) for string utilities; the Python extension additionally depends on pybind11 and is built with setuptools’ build_ext, with a Bazel-driven build path for GitHub Actions wheel builds across Linux/macOS/Windows and Python 3.10 through 3.14. GoogleTest and Google Benchmark are used for the C++ test and benchmark suites.

Code Quality The C++ core has an extensive testing directory (re2/testing/) covering the parser, compiler, and each matching engine individually, plus fuzzing harnesses under re2/fuzzing/; the Python binding has its own re2_test.py using absl’s parameterized testing. Error handling in the Python layer raises a dedicated error exception type (mapped from C++ exceptions via pybind11) rather than silently returning None, and the codebase enforces a configurable memory budget with graceful failure rather than unbounded allocation. CI runs across multiple platforms and Python versions via GitHub Actions.

What Makes It Unique RE2’s defining technical choice is refusing backtracking entirely: it compiles patterns into an automaton and evaluates all alternatives simultaneously, which is what makes its linear-time guarantee possible, at the cost of dropping backreferences and lookaround. This is a fundamentally different engineering trade-off than PCRE-style engines (including Python’s re), and it’s why RE2 exists specifically for contexts — like Google’s own production services — where a regex must never be able to hang a process regardless of who supplied the pattern.