Page MenuHomePhabricator

Use "\z" instead of "$" to anchor validating regular expressions
ClosedPublic

Authored by epriestley on Mar 13 2014, 2:18 PM.
Tags
None
Referenced Files
Unknown Object (File)
Mon, Jun 16, 7:13 PM
Unknown Object (File)
Mon, Jun 16, 11:58 AM
Unknown Object (File)
Mon, Jun 16, 6:55 AM
Unknown Object (File)
Mon, Jun 16, 5:44 AM
Unknown Object (File)
Sun, Jun 15, 10:38 PM
Unknown Object (File)
Mon, Jun 9, 2:04 AM
Unknown Object (File)
Tue, Jun 3, 6:08 AM
Unknown Object (File)
May 11 2025, 12:44 AM
Subscribers

Details

Summary

Via HackerOne. In regular expressions, "$" matches "end of input, or before terminating newline". This means that the expression /^A$/ matches two strings: "A", and "A\n".

When we care about this, use \z instead, which matches "end of input" only.

This allowed registration of "username\n" and similar.

Test Plan
  • Grepped codebase for all calls to preg_match() / preg_match_all().
  • Fixed the ones where this seemed like it could have an impact.
  • Added and executed unit tests.

Diff Detail

Repository
rP Phabricator
Lint
Lint Skipped
Unit
Tests Skipped

Event Timeline

epriestley retitled this revision from to Use "\z" instead of "$" to anchor validating regular expressions.
epriestley updated this object.
epriestley edited the test plan for this revision. (Show Details)
epriestley added a reviewer: btrahan.
btrahan edited edge metadata.
This revision is now accepted and ready to land.Mar 13 2014, 5:38 PM
epriestley updated this revision to Diff 20210.

Closed by commit rP969d0c3e8de2 (authored by @epriestley).