HomePhabricator

Use "\z" instead of "$" to anchor validating regular expressions

Description

Use "\z" instead of "$" to anchor validating regular expressions

Summary:
Via HackerOne. In regular expressions, "$" matches "end of input, or before terminating newline". This means that the expression /^A$/ matches two strings: "A", and "A\n".

When we care about this, use \z instead, which matches "end of input" only.

This allowed registration of "username\n" and similar.

Test Plan:

  • Grepped codebase for all calls to preg_match() / preg_match_all().
  • Fixed the ones where this seemed like it could have an impact.
  • Added and executed unit tests.

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: aran, epriestley

Differential Revision: https://secure.phabricator.com/D8516

Details

Provenance
epriestleyAuthored on
epriestleyPushed on Mar 13 2014, 7:42 PM
Reviewer
btrahan
Differential Revision
D8516: Use "\z" instead of "$" to anchor validating regular expressions
Parents
rP58877a9b6c9d: Fix some collateral damage from SSH Keypair generation
Branches
Unknown
Tags
Unknown

Event Timeline