The dangers of single line regular expressions • Hacker News Board

neilk wrote: post #6

In my experience `$` does reliably mean end of string for regular expressions, unless you specifically ask for "multiline" mode. Ruby seems to be in multiline mode all the time? $ python -c 'import re; print "yes" if re.match(r"^[a-z ]+$", "foobar") else "no"' yes $ python -c 'import re; print "yes" if re.match(r"^[a-z ]+$", "foo\nbar") else "no"' no $ python -c 'import re; print "yes" if re.match(r"^[a-z ]+$", "foo\…

False. "$" does NOT mean end-of-string in Perl, Python, PHP, Ruby, Java, or .NET. In particular, a trailing newline (at least) is accepted in those languages.

A $ does mean end-of-string in Javascript, POSIX, Rust (if using its usual package), and Go.

I'm working with the OpenSSF best practices working group to create some guidance on this stuff. It's a very common misconception. Stay tuned.

If anyone knows of vulnerabilities caused by thus, let me know.

Re: The dangers of single line regular expressions

#50

Post by SEXMCNIGGA12951 » Mon, Apr 22, 2024, 8:05 PM UTC

[dead]