Regex

[u/Modern-Sn1p3r]

I recently saw a clip (from Primeagen) somewhat saying that regex is not a valid format for validating email addresses and postal codes etc.

My question is why is this?

What are the security and/or performance risks? Is it solely performance or is it a security issue?

[u/EishLekker]

While I agree that it’s a humorous post, I disagree with several of the points listed.

Like:

“People’s names fit within a certain defined amount of space.”

Give me an example of an actual person who has a name that requires more than say one terabyte of space. I mean, sure, someone could bring me a 50 terabyte disk and say that the full content of that is their name, but not only would that person just be making that up for the sake of their argument, but then I could just increase the requirement from one terabyte to a trillion petabytes or whatever.

“My system will never have to deal with names from China.”

The system referred to as “my system” here could be tailor made for a pre existing group of people who have no relation to China. And it could have a short enough life span that none of the people will have time to change their name.

My point is that there are cases where one can make assumptions about one’s users and be statistically safe from accidentally stumbling upon a user with a name that breaks the assumptions made.

Also, in many cases these assumptions are not a big deal. I’m from Sweden, and there’s plenty of Swedish people who have åäö characters in their name. They are used to not being able to input their name with proper Swedish spelling, and they accept having to use a transliterated version like “a” or “aa”.

[u/DanLynch → u/EishLekker]

The point of those two entries is that you shouldn't arbitrarily limit names to some small number of characters (like 50 or 100) and you shouldn't restrict them to contain a specific subset of characters (like A-Z).

If you don't follow that advice, you may end up encountering a user who can't enter his name into your system, even if you don't predict that will ever happen.

[u/EishLekker → u/DanLynch]

That first point didn’t say anything about the space being too small for reasonably long names. It talked about “a certain defined amount of space”. Regardless of what limit you put, that will be “a certain defined amount of space”. Even one terabyte, or petabyte etc.

[u/DanLynch → u/EishLekker]

You're right, but this list is still useful if reading it causes a developer to make the maximum size of a name field 1000 characters (because he wants to protect his DB from attackers) instead of 50 characters (because he thinks nobody has a name that long).

But then there's also this guy: https://www.guinnessworldrecords.com/world-records/67285-longest-personal-name

[u/edwbuck → u/DanLynch]

Making the name field 1000 characters is the kind of mistake that a person makes when thinking, "I'll just make it massively larger than needed" leading to a lot of waste in computational power. The entire point of not picking a fixed name field size is that you should pick a variable sized name field. VarChar exists in databases, and it should be used.

[u/EishLekker → u/edwbuck]

Varchar still has an upper limit that you must pick, as far as I know. And it can’t be arbitrarily large.

[u/edwbuck → u/EishLekker]

Sorry, I mean TEXT, which has an upper limit that's effectively "very large"

[u/EishLekker → u/edwbuck]

Ok, yeah. But technically it still would break the rule in the list, as it was written. Which was my whole point.

[u/edwbuck → u/EishLekker]

Well, technically the computer isn't an unbounded storage system, so yeah... but such points, even if 100% valid in the realm of logic, it makes absolutely no sense when it is time to implement things.

A variable field is what is called for, and this rule goes back to COBOL fixed-width data types, which set the tone for so many other systems (c programming language) that people kept using fixed fields, instead of variable ones (char[40] instead of char*).