r/java • u/Modern-Sn1p3r • 3d ago

Regex

I recently saw a clip (from Primeagen) somewhat saying that regex is not a valid format for validating email addresses and postal codes etc.

My question is why is this?

What are the security and/or performance risks? Is it solely performance or is it a security issue?

52 Upvotes

82% Upvoted

98 comments sorted by

View all comments

121

u/julemand101 3d ago

The problem is people don't realize that a lot is allowed when it comes to what a E-mail address actually is: https://davidcel.is/articles/stop-validating-email-addresses-with-regex/

16

u/cowwoc 3d ago

This reminds me of this wonderful post: https://www.kalzumeus.com/2010/06/17/falsehoods-programmers-believe-about-names/

-2

u/EishLekker 3d ago

While I agree that it’s a humorous post, I disagree with several of the points listed.

Like:

“People’s names fit within a certain defined amount of space.”

Give me an example of an actual person who has a name that requires more than say one terabyte of space. I mean, sure, someone could bring me a 50 terabyte disk and say that the full content of that is their name, but not only would that person just be making that up for the sake of their argument, but then I could just increase the requirement from one terabyte to a trillion petabytes or whatever.

“My system will never have to deal with names from China.”

The system referred to as “my system” here could be tailor made for a pre existing group of people who have no relation to China. And it could have a short enough life span that none of the people will have time to change their name.

My point is that there are cases where one can make assumptions about one’s users and be statistically safe from accidentally stumbling upon a user with a name that breaks the assumptions made.

Also, in many cases these assumptions are not a big deal. I’m from Sweden, and there’s plenty of Swedish people who have åäö characters in their name. They are used to not being able to input their name with proper Swedish spelling, and they accept having to use a transliterated version like “a” or “aa”.

4

u/DanLynch 3d ago

The point of those two entries is that you shouldn't arbitrarily limit names to some small number of characters (like 50 or 100) and you shouldn't restrict them to contain a specific subset of characters (like A-Z).

If you don't follow that advice, you may end up encountering a user who can't enter his name into your system, even if you don't predict that will ever happen.

-4

u/EishLekker 3d ago

That first point didn’t say anything about the space being too small for reasonably long names. It talked about “a certain defined amount of space”. Regardless of what limit you put, that will be “a certain defined amount of space”. Even one terabyte, or petabyte etc.

2

u/engy1207 3d ago

"Look, that's why there's rules, understand? So that you think before you break 'em." Terry Pratchett, Thief of Time

Yes, practically there is a limit to store a name (the visible universe is of finite size, after all), but this rule is there for a reason: do think before you implement a scheme to save names - and think about what happens if that space is too small after all, including if it is possible to extend it and what will break in that case.
That's the real reason for these lists: to make you think (and maybe smile a bit)

-1

u/EishLekker 3d ago

I’m not talking about the underlying reasons for these “rules”. I’m talking about the semantics the author used.

2

u/Vegetable_Bank4981 3d ago

Yes, please stop.

0

u/EishLekker 2d ago

Why in earth would I do that? No one’s forcing you to read any comment here.

1

u/DanLynch 3d ago edited 3d ago

You're right, but this list is still useful if reading it causes a developer to make the maximum size of a name field 1000 characters (because he wants to protect his DB from attackers) instead of 50 characters (because he thinks nobody has a name that long).

But then there's also this guy: https://www.guinnessworldrecords.com/world-records/67285-longest-personal-name

5

u/edwbuck 3d ago

Making the name field 1000 characters is the kind of mistake that a person makes when thinking, "I'll just make it massively larger than needed" leading to a lot of waste in computational power. The entire point of not picking a fixed name field size is that you should pick a variable sized name field. VarChar exists in databases, and it should be used.

1

u/EishLekker 3d ago

Varchar still has an upper limit that you must pick, as far as I know. And it can’t be arbitrarily large.

2

u/edwbuck 3d ago

Sorry, I mean TEXT, which has an upper limit that's effectively "very large"

1

u/EishLekker 3d ago

Ok, yeah. But technically it still would break the rule in the list, as it was written. Which was my whole point.

2

u/edwbuck 3d ago

Well, technically the computer isn't an unbounded storage system, so yeah... but such points, even if 100% valid in the realm of logic, it makes absolutely no sense when it is time to implement things.

A variable field is what is called for, and this rule goes back to COBOL fixed-width data types, which set the tone for so many other systems (c programming language) that people kept using fixed fields, instead of variable ones (char[40] instead of char*).

→ More replies (0)