Do you even Regex?

https://www.reddit.com/r/ProgrammerHumor/comments/c9e0n4/regex_is_so_easy/

We've all been there

s/phone number/whatever you're looking for/gi

"Advanced" features

Named Capture Groups

const re = /(?<exg>\d{3})-?(?<npa>\d{3})-?(?<nxx>\d{4})/;
const matches = re.exec('514-123-1234');

> console.log(matches.groups)
{exg: '514', npa: '123', nxx: '1234'}

> console.log(matches.groups.npa)
123

Lookahead Assertions

const re = /(?<person>\w+) is (.*?)(?=awesome)/g;
const matches = 'Sally is awesome\nBob is great\nKelly is also awesome'.matchAll(re)

> for (m of matches) console.log(m.groups.person)
Sally
Kelly

const re = /((?<person>\w+) (.*?) )(?!awesome)/g;
const matches = 'Sally is awesome\nBob is great\nKelly is awesome'.matchAll(re)

> for (m of matches) console.log(m.groups.person)
Bob

Positive

Negative

Backreferences

const re = /(?<person>\w+) \1/gi;
const matches = 'Bob bob\nJim bob\nkelly kelly'.matchAll(re);

> for (m of matches) console.log(m.groups.person)
Bob
kelly

Lookbehind Assertions

Gotchyas

https://programmerhumor.io/programming-memes/why-is-regex-so-annoying-and-hard-everytime-%F0%9F%A4%AF/

Forgetting that * is a hungry hippo

/<.*>/g

Let's find all HTML tags!

Forgetting the G flag when looking for multiple matches

/is/

Let's find all instances of the word "is "

Forgetting about word boundaries

/[Cc]ats?/

Let's find all the cats!

Typo'ing a character range

/[A-z]/

Let's find all regular letters!

Using escapes when you don't need 'em

/\\d/

Let's find all the digits!

Forgetting that * matches an empty string

/\d*/

Let's find all the digits!

Forgetting to group sub-expressions

/bear|lion+/

Let's find all bears or lions!

Securitay

Regex Denial of Service - A.K.A How to oops your prod

(a+)+
([a-zA-Z]+)*
(a|aa)+
(a|a?)+
(.*a){x} for x \> 10

OWASP ReDOS

const userName = untrustedRequestParams.username;
const password = untrustedRequestParams.password;
const testPassword = new RegExp(userName);

if (testPassword.test(password)) {
    alert('I just took down prod');
} else {
	alert('No really, I did.');
}

Examples of Evil™ regexes:

Comment it!

Did you know regex supports a comment mode??

const re = new RegExp(String.raw`
    # match ASCII alpha-numerics
    [a-zA-Z0-9]
`, "x");

https://github.com/tc39/proposal-regexp-x-mode

pattern = """
^                   # beginning of string
M{0,4}              # thousands - 0 to 4 M's
(CM|CD|D?C{0,3})    # hundreds - 900 (CM), 400 (CD), 0-300 (0 to 3 C's),
                    #            or 500-800 (D, followed by 0 to 3 C's)
(XC|XL|L?X{0,3})    # tens - 90 (XC), 40 (XL), 0-30 (0 to 3 X's),
                    #        or 50-80 (L, followed by 0 to 3 X's)
(IX|IV|V?I{0,3})    # ones - 9 (IX), 4 (IV), 0-3 (0 to 3 I's),
                    #        or 5-8 (V, followed by 0 to 3 I's)
$                   # end of string
"""
re.search(pattern, 'M', re.VERBOSE)

Scarier example

Highly Recommended

Link to buy version made from dead trees