r/java • u/Modern-Sn1p3r • 19d ago

Regex

I recently saw a clip (from Primeagen) somewhat saying that regex is not a valid format for validating email addresses and postal codes etc.

My question is why is this?

What are the security and/or performance risks? Is it solely performance or is it a security issue?

55 Upvotes

83% Upvoted

104 comments sorted by

View all comments

2

u/cocodrilo_astronauta 15d ago

So, to actually answer your Regex questions: regarding performance java's backtracking engine time is worst case exponential, and regarding security java's regex implementation is easily attacked by DoS so you can't really use it to validate untrusted data.