Skip to content

OPENNLP-1935: Regex removal (10/10): Forbid java.util.regex in production code - #1348

Merged
mawiesne merged 5 commits into
mainfrom
feat/OPENNLP-1935-regex-guard
Oct 10, 2026
Merged

mawiesne merged 5 commits into
mainfrom
feat/OPENNLP-1935-regex-guard

Conversation

@krickert

@krickert krickert commented Sep 30, 2026 •

Copy link
Copy Markdown
Contributor

Part 10 of the regex removal series, kept as a draft until the remaining classes are converted. Continues #1282 on an apache branch.

A forbiddenapis execution checks the production classes of every module against dev/forbidden-regex.txt: java.util.regex, String.split, String.matches, String.replaceAll, String.replaceFirst and Scanner.useDelimiter. It runs at process-classes, before the tests, and its message names the StringUtil replacements. Tests are not checked, so test code can keep using regular expressions.

Exceptions: a member with a documented public contract that is a user-supplied regular expression is marked with @SuppressForbidden(reason). Only RegexNameFinder and RegexNameFinderFactory have it. A private pattern is converted, not annotated, so the report of the check is the to-fix list for the rest of the series. CONTRIBUTING.md has the rule.

Also in this PR: StringUtil has one non-empty split loop behind splitNonEmpty, splitOnUnicodeWhitespace and the mode-aware splitOnWhitespace, replacing the copies in EventFields, MascIdentifiers, MecabDictionary and HunspellDictionary.

Report on main today: 104 findings in 13 classes. The tokenizer factories and TokenizerME, the parser family, NameSample, FeatureGeneratorUtil, SpellCheckingCharSequenceNormalizer, and the rest of ConlluStream, DownloadUtil and TokenSampleStream is #1280.

OPENNLP-1935

@krickert

krickert commented Oct 1, 2026

Copy link
Copy Markdown
Contributor Author

Rebased main, updated description.

AI assisted summary (reviewed and edited).

Rebased onto main after #1313 and #1280. The report is down to 104 findings in 13 classes: the tokenizer family, the parser family, NameSample, FeatureGeneratorUtil, SpellCheckingCharSequenceNormalizer, and the rest of ConlluStream, DownloadUtil and TokenSampleStream, of which #1314 takes five.

@krickert
krickert marked this pull request as ready for review October 1, 2026 22:37
@krickert

krickert commented Oct 1, 2026

Copy link
Copy Markdown
Contributor Author

Jumped the gun on making this green - after 547 is done, this will be green.

@rzo1 rzo1 added this to the 3.0.0 milestone Oct 2, 2026
@rzo1
rzo1 requested review from mawiesne and rzo1 October 2, 2026 04:35
@jzonthemtn

Copy link
Copy Markdown
Contributor

Jumped the gun on making this green - after 547 is done, this will be green.

Is this blocked by #1236?

@krickert

krickert commented Oct 2, 2026 •

Copy link
Copy Markdown
Contributor Author

@jzonthemtn yup.. I can make it 10/10 a draft for now. It needs 547 (and it's ticket stack I'd rebase right after that would help 547 - it's made to be stacked w/it)...

So order would be:

#1236
#1323 (after rebase - which would happen immediately after 1236)
#1348

@krickert

krickert commented Oct 2, 2026

Copy link
Copy Markdown
Contributor Author

Jumped the gun on making this green - after 547 is done, this will be green.

Is this blocked by #1236?

Also - NBD but there's still about 30 or so places to clean up in the codebase for the regex stuff - not needed for the 3.0 release (the surface was a lot bigger than I thought).

It's just something we should just chip away at. The ones we have here are the hot path for most. The other tickets expose some minor API changes made to remove Pattern from constructors.

@krickert

krickert commented Oct 2, 2026

Copy link
Copy Markdown
Contributor Author

@jzonthemtn going to put this in draft temporarily - #1360 has a nit where we would need to add to this list after it merges too. To minimize churn, I'll keep this in draft until #1236 and #1360 both complete.

@krickert
krickert marked this pull request as draft October 2, 2026 18:13
@rzo1 rzo1 added task Maintenance or housekeeping work (Jira: Task) component: build Build, packaging, CI and test infrastructure labels Oct 4, 2026
@krickert
krickert force-pushed the feat/OPENNLP-1935-regex-guard branch from f152df5 to 12f23a1 Compare October 5, 2026 11:41
@rzo1
rzo1 force-pushed the feat/OPENNLP-1935-regex-guard branch from 12f23a1 to 7cde11f Compare October 8, 2026 08:04
@rzo1
rzo1 marked this pull request as ready for review October 8, 2026 08:06
@rzo1
rzo1 marked this pull request as draft October 8, 2026 08:07
@rzo1
rzo1 force-pushed the feat/OPENNLP-1935-regex-guard branch from 7cde11f to f80870a Compare October 9, 2026 08:35
krickert and others added 4 commits October 9, 2026 19:51
…napis

Add a forbiddenapis check for production classes in every module. Reject
java.util.regex and regex-based String and Scanner methods at
process-classes, before tests run. Exclude test classes and point error
messages to the StringUtil replacements.

Add SuppressForbidden for documented APIs that accept user-supplied
regular expressions. Require a reason for each exception and apply it
to RegexNameFinder and RegexNameFinderFactory.

Document the rule, dev/forbidden-regex.txt and allowed exceptions in
CONTRIBUTING.md. The build will fail until the remaining production
regex uses are removed by the related PRs.

Assisted-by: Claude Code 2.1.281
Co-authored-by: Kristian Rickert <kristian@apache.org>
Co-authored-by: Claude <noreply@anthropic.com>
Reviewed-by: Kristian Rickert <kristian@apache.org>
Signed-off-by: Kristian Rickert <kristian@apache.org>
EventFields, MascIdentifiers, MecabDictionary and HunspellDictionary each had the same
split loop with a different character test. StringUtil has it as one private loop behind
splitNonEmpty, splitOnUnicodeWhitespace and the new mode-aware splitOnWhitespace, and the
four classes call those.
… tags

Mark the tokenizer alphanumeric-pattern API and the AnCora head-rule tag matching with
@SuppressForbidden, since both regular expressions are public, user-supplied contracts.
@rzo1
rzo1 marked this pull request as ready for review October 9, 2026 17:54
@rzo1
rzo1 force-pushed the feat/OPENNLP-1935-regex-guard branch from 33f013b to af2de34 Compare October 9, 2026 17:54
@rzo1

rzo1 commented Oct 9, 2026

Copy link
Copy Markdown
Contributor

lgtm. Think it is a major step forward. Thx @krickert and team.

@krickert

krickert commented Oct 9, 2026

Copy link
Copy Markdown
Contributor Author

Thank you! I've also identified the remaining regex brats, we're down to about 3ish PRs for us to be regex free :) I have branches for these, but still cleaning to draft them into PR

Comment thread .github/CONTRIBUTING.md Outdated
@rzo1
rzo1 requested review from jzonthemtn and mawiesne October 10, 2026 09:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

component: build Build, packaging, CI and test infrastructure task Maintenance or housekeeping work (Jira: Task)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants