Why should one use globs over regex when doing filename pattern matching?

Question

I see that some tools that have to match filenames only support regex and not globs. Would these tools be using globs improve their security?

Is there a security aspect to using globs over regex when matching filenames?

Answer 1

globs are fairly simple, regex can be significantly more complex. Unnecessary complexity is the enemy of security, i.e. it is more likely to get it wrong and more likely to pass a review even if it is wrong. Apart from that, a badly defined regex can cause serious performance problems - at least in case when a backtracking regex engine is used like in case of the common PCRE.

This complexity problem is even worse if the pattern is not specified by a developer but by an administrator when configuring a product. Non-developers have usually even less experience writing proper and secure regex.

And if a server side executed regex pattern is controlled by a potential attacker, then a deliberately bad regex can be used for denial of service - see ReDoS. This is also true if the regex was bad from start (i.e. bad by developer or administrator) and the attacker could feed unexpected data into the regex to trigger a large performance impact.

There are cases though where the simplicity of glob is not sufficient, so it is not as simple as replacing all use of regex with glob.