OWASP Validation Regex Repository - Revision history

EPaul: add non-vulnerable (and correcter) version of the classname regex

2018-03-14T21:07:48Z

add non-vulnerable (and correcter) version of the classname regex

Duccio Fabbri: Added "_" as allowed first char in email regexp, otherwise emails like: name_surname@domain.com are not allowed. According to rfc2822 the regexp is too restrictive. Maybe it should be reviewed.

2017-02-22T23:35:29Z

Added "_" as allowed first char in email regexp, otherwise emails like: name_surname@domain.com are not allowed. According to rfc2822 the regexp is too restrictive. Maybe it should be reviewed.

Thomas Herzog: New regex expression for password complexity requirements according to Windows

2014-07-21T16:00:30Z

New regex expression for password complexity requirements according to Windows

Jmanico at 14:24, 6 May 2014

2014-05-06T14:24:21Z

Wichers at 16:06, 11 November 2012

2012-11-11T16:06:46Z

Achim: \-escapes removed inside character classes

2011-09-22T16:12:09Z

\-escapes removed inside character classes

Christopher Hendrix: Typo in french digitwords. Cing -> Cinq

2011-07-27T21:33:46Z

Typo in french digitwords. Cing -> Cinq

Deleted user at 14:33, 26 June 2009

2009-06-26T14:33:19Z

Deleted user at 14:10, 26 June 2009

2009-06-26T14:10:14Z

Wichers at 22:56, 17 June 2009

2009-06-17T22:56:34Z

@@ Line 129: / Line 129: @@
         // Warning, per http://en.wikipedia.org/wiki/ReDoS the Java Classname RegEx below is vulnerable to RegExDos
         // Java Classname  ^(([a-z])+.)+[A-Z]([a-z])+$
         //
         //  ANY PLATFORM FILENAME   ^(([a-zA-Z]:|\\)\\)?(((\.)|(\.\.)|([^\\/:*?"|<>. ](([^\\/:*?"|<>. ])|([^\\/:*?"|<>]*[^\\/:*?"|<>. ]))?))\\)*[^\\/:*?"|<>. ](([^\\/:*?"|<>. ])|([^\\/:*?"|<>]*[^\\/:*?"|<>. ]))?$

@@ Line 19: / Line 19: @@
    <regex>
    	<name>e-mail</name>
-   	<pattern><![CDATA[^[a-zA-Z0-9+&*-]+(?:\.[a-zA-Z0-9_+&*-]+)*@(?:[a-zA-Z0-9-]+\.)+[a-zA-Z]{2,7}$]]></pattern>
+   	<pattern><![CDATA[^[a-zA-Z0-9_+&*-]+(?:\.[a-zA-Z0-9_+&*-]+)*@(?:[a-zA-Z0-9-]+\.)+[a-zA-Z]{2,7}$]]></pattern>
    	<description>A valid e-mail address</description>
    </regex>

@@ Line 45: / Line 45: @@
    	<pattern><![CDATA[^(?=.*\d)(?=.*[a-z])(?=.*[A-Z]).{4,8}$]]></pattern>
    	<description>4 to 8 character password requiring numbers and both lowercase and uppercase letters</description>
    </regex>

@@ Line 119: / Line 119: @@
         // RFC 1918 NON ROUTABLE IP   ^(((25[0-5]|2[0-4][0-9]|19[0-1]|19[3-9]|18[0-9]|17[0-1]|17[3-9]|1[0-6][0-9]|1[1-9]|[2-9][0-9]|[0-9])\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9]))|(192\.(25[0-5]|2[0-4][0-9]|16[0-7]|169|1[0-5][0-9]|1[7-9][0-9]|[1-9][0-9]|[0-9]))|(172\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|1[0-5]|3[2-9]|[4-9][0-9]|[0-9])))\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$
         // VALID WINDOWS FILENAME  ^(?!^(PRN|AUX|CLOCK\$|NUL|CON|COM\d|LPT\d|\..*)(\..+)?$)[^\x00-\x1f\\?*:\";|/]+$
         // Java Classname  ^(([a-z])+.)+[A-Z]([a-z])+$
         //  ANY PLATFORM FILENAME   ^(([a-zA-Z]:|\\)\\)?(((\.)|(\.\.)|([^\\/:*?"|<>. ](([^\\/:*?"|<>. ])|([^\\/:*?"|<>]*[^\\/:*?"|<>. ]))?))\\)*[^\\/:*?"|<>. ](([^\\/:*?"|<>. ])|([^\\/:*?"|<>]*[^\\/:*?"|<>. ]))?$
    -->

@@ Line 1: / Line 1: @@
-;Note: These Regex are examples and not build for an particular Regex engine. However, the PCRE syntax is mainly used. In particular this means that character classes do not contain meta characters which need to be escaped, excpet the <code>-</code> and <code>]</code> character, where it is assumed that a <code>-</code> needs not to be escaped only when it is the last character in a character class. The character class supports shortcut notations for other character classes like <code>\s</code> or <code>\w</code> which should not be used as they depend on the LOCALE environment setting in most systems.
+;Note: These Regexs are examples and not built for a particular Regex engine. However, the PCRE syntax is mainly used. In particular, this means that character classes do not contain meta characters which need to be escaped, except the <code>-</code> and <code>]</code> character, where it is assumed that a <code>-</code> needs not to be escaped only when it is the last character in a character class. The character class supports shortcut notations for other character classes like <code>\s</code> or <code>\w</code> which should not be used as they depend on the LOCALE environment setting in most systems.
-PLease carefully test the regenx in your regex engine.
 <pre style="overflow:scroll">
 <?xml version="1.0"?>
@@ Line 7: / Line 8: @@
    	<name>url</name>
    	<pattern><![CDATA[^((((https?|ftps?|gopher|telnet|nntp)://)|(mailto:|news:))(%[0-9A-Fa-f]{2}|[-()_.!~*';/?:@&=+$,A-Za-z0-9])+)([).!';/?:,][[:blank:]])?$]]></pattern>
-   	<description></description>
+   	<description>A valid URL per the URL spec.</description>
    </regex>
@@ Line 13: / Line 14: @@
    	<name>IP</name>
    	<pattern><![CDATA[^(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$]]></pattern>
-   	<description></description>
+   	<description>A valid IP Address</description>
    </regex>
@@ Line 19: / Line 20: @@
    	<name>e-mail</name>
    	<pattern><![CDATA[^[a-zA-Z0-9+&*-]+(?:\.[a-zA-Z0-9_+&*-]+)*@(?:[a-zA-Z0-9-]+\.)+[a-zA-Z]{2,7}$]]></pattern>
-   	<description></description>
+   	<description>A valid e-mail address</description>
    </regex>
@@ Line 37: / Line 38: @@
    	<name>creditcard</name>
    	<pattern><![CDATA[^((4\d{3})|(5[1-5]\d{2})|(6011)|(7\d{3}))-?\d{4}-?\d{4}-?\d{4}|3[4,7]\d{13}$]]></pattern>
-   	<description></description>
+   	<description>A valid credit card number</description>
    </regex>
@@ Line 55: / Line 56: @@
    	<name>English_daywords</name>
    	<pattern><![CDATA[^(Mo|Tu|We|Th|Fr|Sa|Su)$]]></pattern>
-   	<description>English 23 character abbreviations for the days of the week</description>
+   	<description>English 2 character abbreviations for the days of the week</description>
    </regex>
@@ Line 67: / Line 68: @@
    	<name>French_digitwords</name>
    	<pattern><![CDATA[^(z[eé]ro|un|deux|trois|quatre|cinq|six|sept|huit|neuf)$]]></pattern>
-   	<description>The Frensh words representing the digits 0 to 9</description>
+   	<description>The French words representing the digits 0 to 9</description>
    </regex>
@@ Line 97: / Line 98: @@
    	<name>US_state</name>
    	<pattern><![CDATA[^(AE|AL|AK|AP|AS|AZ|AR|CA|CO|CT|DE|DC|FM|FL|GA|GU|HI|ID|IL|IN|IA|KS|KY|LA|ME|MH|MD|MA|MI|MN|MS|MO|MP|MT|NE|NV|NH|NJ|NM|NY|NC|ND|OH|OK|OR|PW|PA|PR|RI|SC|SD|TN|TX|UT|VT|VI|VA|WA|WV|WI|WY)$]]></pattern>
-   	<description>Two letter state abbreviations</description>
+   	<description>2 letter U.S. state abbreviations</description>
    </regex>
@@ Line 103: / Line 104: @@
    	<name>US_ssn</name>
    	<pattern><![CDATA[^\d{3}-\d{2}-\d{4}$]]></pattern>
-   	<description>9 digit social security number with dashes</description>
+   	<description>9 digit U.S. social security number with dashes</description>
    </regex>
@@ Line 127: / Line 128: @@
 '''Regex Library Site'''
-[http://regexlib.com/ http://regexlib.com/]: A site that has a HUGE library of regular expressions and other regex resources
+http://regexlib.com/:  A site that has a HUGE library of regular expressions and other regex resources
 '''Regex Construction Tool'''
-[http://www.ultrapico.com/Expresso.htm http://www.ultrapico.com/Expresso.htm]: A free regex construction tool
+http://www.ultrapico.com/Expresso.htm:  A free regex construction tool
 [[Category:OWASP Validation Project]]
 [[Category:OWASP Application Security Verification Standard Project]]
 [[Category:How To]]

@@ Line 1: / Line 1: @@
 <pre style="overflow:scroll">
 <?xml version="1.0"?>
@@ Line 16: / Line 18: @@
    <regex>
    	<name>e-mail</name>
-   	<pattern><![CDATA[^[\w\-\+\&\*]+(?:\.[\w\-\_\+\&\*]+)*@(?:[\w-]+\.)+[a-zA-Z]{2,7}$]]></pattern>
+   	<pattern><![CDATA[^[a-zA-Z0-9+&*-]+(?:\.[a-zA-Z0-9_+&*-]+)*@(?:[a-zA-Z0-9-]+\.)+[a-zA-Z]{2,7}$]]></pattern>
    	<description></description>
    </regex>
@@ Line 22: / Line 24: @@
    <regex>
    	<name>safetext</name>
-   	<pattern><![CDATA[^[a-zA-Z0-9\s.\-]+$]]></pattern>
+   	<pattern><![CDATA[^[a-zA-Z0-9 .-]+$]]></pattern>
    	<description>Lower and upper case letters and all digits</description>
    </regex>
@@ Line 108: / Line 110: @@
         // HTML HEX CODE   ^#?([a-f]|[A-F]|[0-9]){3}(([a-f]|[A-F]|[0-9]){3})?$
         // FLOATING POINT   ^[-+]?[0-9]+[.]?[0-9]*([eE][-+]?[0-9]+)?$
-        // PERSON NAME   ^[a-zA-Z]+(([\'\,\.\- ][a-zA-Z ])?[a-zA-Z]*)*$
+        // PERSON NAME   ^[a-zA-Z]+(([',. -][a-zA-Z ])?[a-zA-Z]*)*$
         // MAC ADDRESS  ^([0-9a-fA-F][0-9a-fA-F]:){5}([0-9a-fA-F][0-9a-fA-F])$
         // GUID    ^[A-Z0-9]{8}-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{12}$
@@ Line 117: / Line 119: @@
         // VALID WINDOWS FILENAME  ^(?!^(PRN|AUX|CLOCK\$|NUL|CON|COM\d|LPT\d|\..*)(\..+)?$)[^\x00-\x1f\\?*:\";|/]+$
         // Java Classname  ^(([a-z])+.)+[A-Z]([a-z])+$
-        //  ANY PLATFORM FILENAME   ^(([a-zA-Z]:|\\)\\)?(((\.)|(\.\.)|([^\\/:\*\?"\|<>\. ](([^\\/:\*\?"\|<>\. ])|([^\\/:\*\?"\|<>]*[^\\/:\*\?"\|<>\. ]))?))\\)*[^\\/:\*\?"\|<>\. ](([^\\/:\*\?"\|<>\. ])|([^\\/:\*\?"\|<>]*[^\\/:\*\?"\|<>\. ]))?$
+        //  ANY PLATFORM FILENAME   ^(([a-zA-Z]:|\\)\\)?(((\.)|(\.\.)|([^\\/:*?"|<>. ](([^\\/:*?"|<>. ])|([^\\/:*?"|<>]*[^\\/:*?"|<>. ]))?))\\)*[^\\/:*?"|<>. ](([^\\/:*?"|<>. ])|([^\\/:*?"|<>]*[^\\/:*?"|<>. ]))?$
    -->
 </pre>

@@ Line 63: / Line 63: @@
    <regex>
-   	<name>Frensh_digitwords</name>
+   	<name>French_digitwords</name>
    	<pattern><![CDATA[^(z[eé]ro|un|deux|trois|quatre|cing|six|sept|huit|neuf)$]]></pattern>
    	<description>The Frensh words representing the digits 0 to 9</description>

← Older revision		Revision as of 14:10, 26 June 2009
Line 132:		Line 132:

	[[Category:OWASP Validation Project]]		[[Category:OWASP Validation Project]]
		+	[[Category:OWASP Application Security Verification Standard Project]]
	[[Category:How To]]		[[Category:How To]]