The dangers of single line regular expressions • Hacker News Board

Re: The dangers of single line regular expressions

#11

Post by wrsh07 » Mon, Apr 22, 2024, 7:32 PM UTC

This was interesting and new to me, but as other commenters indicate, part of the problem is that we're trying to find the bad thing rather than trying to verify it is the good thing

There's a related concept of "failing open vs failing closed" (fail open: fire exit, fail closed: ranch gate)

In Jurassic park (amazing book/film to understand system failures), when the power goes out, the fence is functionally an open gate

In this case, we shouldn't assume that we can enumerate all possible bad strings (even with a regex)

Re: The dangers of single line regular expressions

#12

Post by sfink » Mon, Apr 22, 2024, 7:35 PM UTC

Akronymus wrote: post #7

sfink wrote: post #4

Alternatively, don't validate and then use the original. Instead, pull out the acceptable input and use that. Even better, compare that to the original and fail validation if they're not identical, but that requires maintaining a higher level of paranoia than may be reasonable to expect.

> Alternatively, don't validate and then use the original. Instead, pull out the acceptable input and use that. Parse don't validate https://lexi-lambda.github.io/blog/2019/11/05/parse-don-t-va...

Heh. I wrote up my comment, and then thought "hey, I bet that's what that 'Parse don't validate' article meant, the one I never quite got around to reading." So I pulled it up — great article! — but then didn't post the link because it uses the type system to record the results of the parse. Whereas here, you'd probably parse from a string into another string.

But philosophically I agree, that's exactly the relevant advice.

Re: The dangers of single line regular expressions

#13

Post by cedws » Mon, Apr 22, 2024, 7:41 PM UTC

I pretty much always consider regex expressions as the wrong solution. They're notoriously hard to get right.

There's a whole lot of faulty expressions out there for validating email addresses. I prefer to do less validation and let it fail. If the email address is wrong, whatever service you're using for sending emails will just reject it. If you really do need to validate email addresses, use something somebody else wrote that does it properly.

If you're working with some exotic format for which there isn't already an open source library, do what this guy says: parse it, don't try to validate it with regex: https://lexi-lambda.github.io/blog/2019/11/05/parse-don-t-va...