The dangers of single line regular expressions

More like "the danger of thinking you can trivially validate user-supplied input" before evaluating the string.

Alternatively, don't validate and then use the original. Instead, pull out the acceptable input and use that.

Even better, compare that to the original and fail validation if they're not identical, but that requires maintaining a higher level of paranoia than may be reasonable to expect.

In my experience `$` does reliably mean end of string for regular expressions, unless you specifically ask for "multiline" mode.

Ruby seems to be in multiline mode all the time?

    $ python -c 'import re; print "yes" if re.match(r"^[a-z ]+$", "foobar") else "no"'
    yes
    $ python -c 'import re; print "yes" if re.match(r"^[a-z ]+$", "foo\nbar") else "no"'
    no
    $ python -c 'import re; print "yes" if re.match(r"^[a-z ]+$", "foo\nbar", re.M) else "no"'
    yes

    $ perl -le 'print "foobar" =~ /^[a-z ]+$/ ? "yes" : "no"'
    yes
    $ perl -le 'print "foo\nbar" =~ /^[a-z ]+$/ ? "yes" : "no"'
    no
    $ perl -le 'print "foo\nbar" =~ /^[a-z ]+$/m ? "yes" : "no"'
    yes

    $ node -e 'console.log(/^[a-z ]+$/.test("foobar") ? "yes" : "no")'
    yes           
    $ node -e 'console.log(/^[a-z ]+$/.test("foo\nbar") ? "yes" : "no")'
    no            
    $ node -e 'console.log(/^[a-z ]+$/m.test("foo\nbar") ? "yes" : "no")'
    yes

    $ ruby -e 'if "foobar" =~ /^[0-9a-z ]+$/i then puts "yes" else puts "no" end'
    yes
    $ ruby -e 'if "foo\nbar" =~ /^[0-9a-z ]+$/i then puts "yes" else puts "no" end'
    yes

EDIT: this is documented behavior for Ruby. What other languages call multiline mode is the default; you're supposed to use \A and \Z instead. They do have an `/m` but it only affects the interpretation of `.`

https://docs.ruby-lang.org/en/master/Regexp.html#class-Regex...

Yeah, my takeaway from this was more "the dangers of Ruby" rather than "the dangers of single line regular expressions" (:

I think the simplest fix would be to use "\Z" rather than "$", which means "match end of input" rather than "end of line." This is also Perl-compatible. So weird that the "$" default meaning is different in Ruby.

I guess one could argue that Ruby's way is better since "$" has a fixed meaning, rather than being context-dependent.

> Ruby seems to be in multiline mode all the time?

Ruby does have a "/m" for multiline mode, but it just makes "." match newline, rather than changing the meaning of "$", it seems.

[1] https://ruby-doc.org/3.2.2/Regexp.html#class-Regexp-label-An...

[2] https://perldoc.perl.org/perlre#Metacharacters

looks like we both updated our answers as we looked up the docs :)