new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

OWASP Cheat Sheets · all subjects

input_validation/regex

5 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Regular expression design considerations

When designing regular expressions, be aware of RegEx Denial of Service (ReDoS) attacks. These attacks cause a program using a poorly designed regular expression to operate very slowly and utilize CPU resources for a very long time.

Regular expression validation requirements

Input validation using regular expressions should: be applied to all input data at minimum; define the allowed set of characters to be accepted; define a minimum and maximum length for the data (e.g. {1,25}).

U.S. Zip Code regex pattern

Validating a U.S. Zip Code (5 digits plus optional -4) uses the regular expression: ^\d{5}(-\d{4})?$

U.S. State regex pattern for drop-down

Validating U.S. State Selection From a Drop-Down Menu uses the regular expression: ^(AA|AE|AP|AL|AK|AS|AZ|AR|CA|CO|CT|DE|DC|FM|FL|GA|GU|HI|ID|IL|IN|IA|KS|KY|LA|ME|MH|MD|MA|MI|MN|MS|MO|MT|NE|NV|NH|NJ|NM|NY|NC|ND|MP|OH|OK|OR|PW|PA|PR|RI|SC|SD|TN|TX|UT|VT|VI|VA|WA|WV|WI|WY)$

Java regex pattern compilation and matching

In Java, compile a regular expression pattern using Pattern.compile() and validate input using pattern.matcher(input).matches(). For example: Pattern zipPattern = Pattern.compile("^\\d{5}(-\\d{4})?$"); Then check if (!zipPattern.matcher(zipCode).matches()) to validate the input and throw an exception if validation fails.

Give your agent this brain

input_validation/regex — OWASP Cheat Sheets