Allow regex opt out

[Jamesgt]

Some may find regex a showstopper, make it optional.

[kestred]

@Jamesgt: It seems like the regular expression for keys is primarily used for in-lining whole documents, and while it could be useful in some more unusual cases (time-series databases maybe?) it is generally more difficult to implement so definitely agree with at least that part being optional (... or even removed from the spec), and maybe find some replacement for select the entire object (like {"*": ""} or {"?*": "")).

On the other hand, the regular expression operator field? is probably supported by most backing databases including things like: in-memory NodeJS, SQL, MongoDB, and Neo4j.

[kestred]

As a follow up, having reviewed potential implementations of regular expressions in any part of the spec, there is definitely a security issue if your accept API calls from an untrusted source.

A maliciously crafted regular expression can take an enormous amount of time to process, and drivers may need to be careful about handling timeouts to mitigate the issue.

Regular expressions may also be difficult for key/value databases like Redis.

I support making regular expressions optional.

[Jamesgt]

Thanks. Yes the the plan is to give two options:

• only allow ?.* (I would stick with .* to show it is regex), this would be the default
• allow full regex if somebody needs that, but this is opt-in