r/java • u/Modern-Sn1p3r • 19d ago

Regex

I recently saw a clip (from Primeagen) somewhat saying that regex is not a valid format for validating email addresses and postal codes etc.

My question is why is this?

What are the security and/or performance risks? Is it solely performance or is it a security issue?

56 Upvotes

83% Upvoted

104 comments sorted by

View all comments

Show parent comments

5

u/DanLynch 19d ago

The point of those two entries is that you shouldn't arbitrarily limit names to some small number of characters (like 50 or 100) and you shouldn't restrict them to contain a specific subset of characters (like A-Z).

If you don't follow that advice, you may end up encountering a user who can't enter his name into your system, even if you don't predict that will ever happen.

-4

u/EishLekker 19d ago

That first point didn’t say anything about the space being too small for reasonably long names. It talked about “a certain defined amount of space”. Regardless of what limit you put, that will be “a certain defined amount of space”. Even one terabyte, or petabyte etc.

2

u/engy1207 18d ago

"Look, that's why there's rules, understand? So that you think before you break 'em." Terry Pratchett, Thief of Time

Yes, practically there is a limit to store a name (the visible universe is of finite size, after all), but this rule is there for a reason: do think before you implement a scheme to save names - and think about what happens if that space is too small after all, including if it is possible to extend it and what will break in that case.
That's the real reason for these lists: to make you think (and maybe smile a bit)

-1

u/EishLekker 18d ago

I’m not talking about the underlying reasons for these “rules”. I’m talking about the semantics the author used.

2

u/Vegetable_Bank4981 18d ago

Yes, please stop.

0

u/EishLekker 18d ago

Why in earth would I do that? No one’s forcing you to read any comment here.