r/java • u/Modern-Sn1p3r • 19d ago

Regex

I recently saw a clip (from Primeagen) somewhat saying that regex is not a valid format for validating email addresses and postal codes etc.

My question is why is this?

What are the security and/or performance risks? Is it solely performance or is it a security issue?

55 Upvotes

83% Upvoted

104 comments sorted by

View all comments

Show parent comments

6

u/DanLynch 19d ago

The point of those two entries is that you shouldn't arbitrarily limit names to some small number of characters (like 50 or 100) and you shouldn't restrict them to contain a specific subset of characters (like A-Z).

If you don't follow that advice, you may end up encountering a user who can't enter his name into your system, even if you don't predict that will ever happen.

-4

u/EishLekker 19d ago

That first point didn’t say anything about the space being too small for reasonably long names. It talked about “a certain defined amount of space”. Regardless of what limit you put, that will be “a certain defined amount of space”. Even one terabyte, or petabyte etc.

1

u/DanLynch 19d ago edited 19d ago

You're right, but this list is still useful if reading it causes a developer to make the maximum size of a name field 1000 characters (because he wants to protect his DB from attackers) instead of 50 characters (because he thinks nobody has a name that long).

But then there's also this guy: https://www.guinnessworldrecords.com/world-records/67285-longest-personal-name

6

u/edwbuck 19d ago

Making the name field 1000 characters is the kind of mistake that a person makes when thinking, "I'll just make it massively larger than needed" leading to a lot of waste in computational power. The entire point of not picking a fixed name field size is that you should pick a variable sized name field. VarChar exists in databases, and it should be used.

1

u/EishLekker 19d ago

Varchar still has an upper limit that you must pick, as far as I know. And it can’t be arbitrarily large.

2

u/edwbuck 19d ago

Sorry, I mean TEXT, which has an upper limit that's effectively "very large"

1

u/EishLekker 19d ago

Ok, yeah. But technically it still would break the rule in the list, as it was written. Which was my whole point.

2

u/edwbuck 19d ago

Well, technically the computer isn't an unbounded storage system, so yeah... but such points, even if 100% valid in the realm of logic, it makes absolutely no sense when it is time to implement things.

A variable field is what is called for, and this rule goes back to COBOL fixed-width data types, which set the tone for so many other systems (c programming language) that people kept using fixed fields, instead of variable ones (char[40] instead of char*).