I have a regex for validating input. I would like to process only the first part (up to \s). Will the second line do the job, or am I missing something?
my research on regex101.com shows it matches the same text.
Original:
input.matches("^NOT\\s+.*"))
and Modified:
input.startsWith("NOT\\s")
this was done to avoid https://www.regular-expressions.info/catastrophic.html according to sonar.
Thanks!
The OWASP page describes evil regexes as those that contain
- Grouping with repetition
- Inside the repeated group:
- Repetition
- Alternation with overlapping
which is not always right. Their examples are good, but the rules are too generic and even good and safe patterns can be trigger the vulnerability
You can actually remove the first + to stop the warning from showing:
input.matches("NOT\\s.*")
This way, only one * is used.