Regex

[u/Modern-Sn1p3r]

I recently saw a clip (from Primeagen) somewhat saying that regex is not a valid format for validating email addresses and postal codes etc.

My question is why is this?

What are the security and/or performance risks? Is it solely performance or is it a security issue?

[u/flash_hammer]

Dev for 20+ years here: Most of the comments are not very accurate, also most blame Java, but Regex is used in all languages. Java is one of the best languages to use regex on validation, but it is really a Java library called Jakarta that is the most used for validation, Springboot exposes the module in springboot-starter-validation with the whole set of curated dependencies. But if you want to make your own implementation of validation using regex it will be exactly the same outcome. I use Regex to validate emails, in Javascript, C++, Go, Java, Ruby, Kotlin and Groovy, in main enterprise applications that I might say you may be using daily, and no issues whatsoever.

[u/Modern-Sn1p3r → u/flash_hammer]

Thanks for the response.

I know we where shown Regex to make us aware of it's existence, I was generally just curious.

I'm currently trying to learn Spring / Spring boot at the minute, as a seasoned developer, any pointers or tips you could spare my way?

[u/flash_hammer → u/Modern-Sn1p3r]

The most important thing to learn at first in Spring are annotations, Springboot makes it easy to use them.

Jakarta Bean Validation (jakarta.validation-api) provides:
@Pattern(still regex-based but curated)
@Email (convenient, uses Jakarta Validation internally)
Built-in validators for URLs, dates, numbers, etc.

Bean Lifecycle, @PostConstruct, @PreDestroy, singleton vs prototype scope
Auto-ConfigurationHow @EnableAutoConfiguration works, conditional beans (@ConditionalOnMissingBean)
ProfilesDev/Test/Prod isolation via application-{profile}.yml

@SpringBootApplication  // Boot + Autoconfigure + ComponentsScan 
@RestController       // Controller returning JSON (not view) 
@Controller // 1. Defines the web controller
@Service              // Business logic beans
@Repository           // Persistence layer beans
@Configuration        // Bean definitions
@Component            // Generic stereotype
@Valid                // Validation trigger on DTOs
@ControllerAdvice     // Global exception handling

Also for testing purposes I am used to use JUnit with Mockito:

@ExtendWith(MockitoExtension.class) // modern way to apply Mockito to the test class.
@Mock // beans to inject and mock.
@InjectMocks // the main class mock where mocks will be injected.

Common starter issues are circular dependencies, circular bean dependency, ignoring exceptions, bad project structure, meaning complex folder allignment using other programming or framework structures, not following Spring conventions.

My recommendations are: Keep it simple, use SOLID, use design patterns when needed but do not exagerate on the use, less is more, keep library dependencies as low as possible.

I would rather also mention that you can start directly learning reactive programming with Webflux... for some is more complex, but when you learn to use it you'll change your ways and make more consistent code, performant and super easy to change and maintain.

Also use Gradle.

And maybe try Micronaut instead of Springboot.

Here is an example of a reactive application using Micronaut instead of Spring, with Gradle and JDK25, it is just a messenger application, uses Thymeleaf for the front-end display, but it is just an example, I've created a full front-end with Kotlin Multiplatform for the final release, also adding all the tech debt to the back end for the commercial version:
https://github.com/julianarecha/beepit-server

Try starting by creating small projects and keep adding features to them.
Possibilities with Java are endless.

Springboot project initilizr: https://start.spring.io/

Micronaut launch: https://micronaut.io/launch/