Page MenuHomePhabricator

Use "\z" instead of "$" to anchor validating regular expressions
ClosedPublic

Authored by epriestley on Mar 13 2014, 2:18 PM.
Tags
None
Referenced Files
F12812765: D8516.diff
Thu, Mar 28, 12:35 AM
Unknown Object (File)
Feb 14 2024, 9:50 AM
Unknown Object (File)
Feb 6 2024, 10:55 PM
Unknown Object (File)
Feb 4 2024, 3:07 AM
Unknown Object (File)
Feb 1 2024, 11:50 PM
Unknown Object (File)
Jan 24 2024, 7:58 PM
Unknown Object (File)
Jan 24 2024, 7:58 PM
Unknown Object (File)
Jan 24 2024, 7:58 PM
Subscribers

Details

Summary

Via HackerOne. In regular expressions, "$" matches "end of input, or before terminating newline". This means that the expression /^A$/ matches two strings: "A", and "A\n".

When we care about this, use \z instead, which matches "end of input" only.

This allowed registration of "username\n" and similar.

Test Plan
  • Grepped codebase for all calls to preg_match() / preg_match_all().
  • Fixed the ones where this seemed like it could have an impact.
  • Added and executed unit tests.

Diff Detail

Repository
rP Phabricator
Lint
Lint Skipped
Unit
Tests Skipped

Event Timeline

epriestley retitled this revision from to Use "\z" instead of "$" to anchor validating regular expressions.
epriestley updated this object.
epriestley edited the test plan for this revision. (Show Details)
epriestley added a reviewer: btrahan.
btrahan edited edge metadata.
This revision is now accepted and ready to land.Mar 13 2014, 5:38 PM
epriestley updated this revision to Diff 20210.

Closed by commit rP969d0c3e8de2 (authored by @epriestley).