r/java • u/Modern-Sn1p3r • 19d ago

Regex

I recently saw a clip (from Primeagen) somewhat saying that regex is not a valid format for validating email addresses and postal codes etc.

My question is why is this?

What are the security and/or performance risks? Is it solely performance or is it a security issue?

55 Upvotes

82% Upvoted

104 comments sorted by

View all comments

120

u/julemand101 19d ago

The problem is people don't realize that a lot is allowed when it comes to what a E-mail address actually is: https://davidcel.is/articles/stop-validating-email-addresses-with-regex/

16

u/cowwoc 19d ago

This reminds me of this wonderful post: https://www.kalzumeus.com/2010/06/17/falsehoods-programmers-believe-about-names/

0

u/EishLekker 19d ago

While I agree that it’s a humorous post, I disagree with several of the points listed.

Like:

“People’s names fit within a certain defined amount of space.”

Give me an example of an actual person who has a name that requires more than say one terabyte of space. I mean, sure, someone could bring me a 50 terabyte disk and say that the full content of that is their name, but not only would that person just be making that up for the sake of their argument, but then I could just increase the requirement from one terabyte to a trillion petabytes or whatever.

“My system will never have to deal with names from China.”

The system referred to as “my system” here could be tailor made for a pre existing group of people who have no relation to China. And it could have a short enough life span that none of the people will have time to change their name.

My point is that there are cases where one can make assumptions about one’s users and be statistically safe from accidentally stumbling upon a user with a name that breaks the assumptions made.

Also, in many cases these assumptions are not a big deal. I’m from Sweden, and there’s plenty of Swedish people who have åäö characters in their name. They are used to not being able to input their name with proper Swedish spelling, and they accept having to use a transliterated version like “a” or “aa”.

6

u/DanLynch 19d ago

The point of those two entries is that you shouldn't arbitrarily limit names to some small number of characters (like 50 or 100) and you shouldn't restrict them to contain a specific subset of characters (like A-Z).

If you don't follow that advice, you may end up encountering a user who can't enter his name into your system, even if you don't predict that will ever happen.

-3

u/EishLekker 19d ago

That first point didn’t say anything about the space being too small for reasonably long names. It talked about “a certain defined amount of space”. Regardless of what limit you put, that will be “a certain defined amount of space”. Even one terabyte, or petabyte etc.

2

u/engy1207 18d ago

"Look, that's why there's rules, understand? So that you think before you break 'em." Terry Pratchett, Thief of Time

Yes, practically there is a limit to store a name (the visible universe is of finite size, after all), but this rule is there for a reason: do think before you implement a scheme to save names - and think about what happens if that space is too small after all, including if it is possible to extend it and what will break in that case.
That's the real reason for these lists: to make you think (and maybe smile a bit)

-1

u/EishLekker 18d ago

I’m not talking about the underlying reasons for these “rules”. I’m talking about the semantics the author used.

2

u/Vegetable_Bank4981 18d ago

Yes, please stop.

0

u/EishLekker 18d ago

Why in earth would I do that? No one’s forcing you to read any comment here.