Regex Testing Without StackOverflow: A Guide to Safe Pattern Development

1// JavaScript regex flags (can be combined)
2 
3const str = "Hello World
4hello world";
5 
6// g — global: find all matches, not just the first
7str.match(/hello/gi);  // ['Hello', 'hello']
8 
9// i — case insensitive
10str.match(/hello/i);   // ['Hello']
11 
12// m — multiline: ^ and $ match start/end of EACH LINE
13str.match(/^hello/mi); // ['Hello', 'hello'] — both line starts
14 
15// s — dotAll: . matches newline characters too
16str.match(/Hello.World/s); // null — the 
17 becomes matchable
18 
19// u — unicode: enables full Unicode character handling
20/😀/u.test('😀'); // true — emoji matched via code point
21 
22// d — indices: captures match start/end positions (ES2022)
23const result = /hello/di.exec(str);
24result?.indices?.[0]; // [0, 5] — start and end index
25 
26// Common combinations:
27const globalCaseInsensitive = /pattern/gi;
28const multilineGlobal = /^line/mg;

1// Email — simplified, ReDoS-safe (no nested quantifiers)
2// Matches: user@domain.tld (basic format check only)
3const emailRegex = /^[^s@]+@[^s@]+.[^s@]+$/;
4 
5// URL (matches http and https)
6const urlRegex = /^https?://[^s/$.?#].[^s]*$/i;
7 
8// Phone number (E.164 international format)
9const phoneRegex = /^+[1-9]d{1,14}$/;
10 
11// UUID v4
12const uuidV4Regex = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
13 
14// ISO 8601 date (YYYY-MM-DD)
15const dateRegex = /^d{4}-(0[1-9]|1[0-2])-(0[1-9]|[12]d|3[01])$/;
16 
17// Hex colour (#RGB or #RRGGBB)
18const hexColourRegex = /^#([0-9a-f]{3}|[0-9a-f]{6})$/i;
19 
20// Semver version (1.2.3 or 1.2.3-beta.1)
21const semverRegex = /^d+.d+.d+(-[w.]+)?(+[w.]+)?$/;
22 
23// Slug (URL-safe string)
24const slugRegex = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
25 
26// Strong password (min 8 chars, uppercase, lowercase, number, symbol)
27const strongPasswordRegex = /^(?=.*[a-z])(?=.*[A-Z])(?=.*d)(?=.*[W_]).{8,}$/;

1// Named capture groups (ES2018+) — far cleaner than positional indices
2const datePattern = /(?<year>d{4})-(?<month>0[1-9]|1[0-2])-(?<day>0[1-9]|[12]d|3[01])/;
3 
4const match = datePattern.exec('Invoice date: 2026-07-03');
5if (match?.groups) {
6  const { year, month, day } = match.groups;
7  console.log(year);  // "2026"
8  console.log(month); // "07"
9  console.log(day);   // "03"
10}
11 
12// vs positional (harder to read and maintain)
13const positional = /(d{4})-(0[1-9]|1[0-2])-(0[1-9]|[12]d|3[01])/;
14const m = positional.exec('2026-07-03');
15// m[1] = year, m[2] = month, m[3] = day — easy to break if groups change

1// DANGEROUS: nested quantifiers — exponential backtracking
2const dangerous1 = /(a+)+$/;
3const dangerous2 = /(d+)*x/;
4const dangerous3 = /(a|a?)+$/;
5 
6// Test: this input will hang the regex engine (never run this in production!)
7const maliciousInput = 'a'.repeat(30) + 'b';
8// dangerous1.test(maliciousInput) → takes seconds to minutes → event loop blocked
9 
10// Why: the engine tries 2^30 (1 billion+) combinations to prove no match

1// SAFE alternatives — restructured to eliminate nested quantifiers
2 
3// Instead of /(a+)+$/ (matches one-or-more groups of one-or-more a's)
4// Just use:
5const safe1 = /^a+$/;  // Matches one or more a's at start to end — same result, no nesting
6 
7// Instead of /(w+)*x/ (zero or more groups of word chars before x)
8const safe2 = /w*x/;  // Direct quantifier on w — no grouping overhead
9 
10// Instead of /(a|aa)+/ (ambiguous: can match 'a' or 'aa' per group)
11const safe3 = /a+/;    // Equivalent result, unambiguous
12 
13// Email example — the dangerous StackOverflow version vs safe version
14const DANGEROUS_EMAIL = /^([a-zA-Z0-9])(([-.]|[_]+)?([a-zA-Z0-9]+))*(@){1}[a-z0-9]+[.]{1}(([a-z]{2,3})|([a-z]{2,3}[.]{1}[a-z]{2,3}))$/;
15// ↑ Multiple nested quantifiers — ReDoS vulnerable
16 
17const SAFE_EMAIL = /^[^s@]+@[^s@]+.[^s@]+$/;
18// ↑ No nested quantifiers — O(n) time complexity

1// Simple performance test — does execution time grow exponentially?
2function testReDoS(pattern: RegExp, baseChar: string, lengths: number[]): void {
3  lengths.forEach(len => {
4    const input = baseChar.repeat(len) + 'X'; // 'X' ensures no match
5    const start = performance.now();
6    pattern.test(input);
7    const elapsed = performance.now() - start;
8    console.log(`Length ${len}: ${elapsed.toFixed(2)}ms`);
9  });
10}
11 
12// Test a suspicious pattern
13testReDoS(/(a+)+$/, 'a', [10, 15, 20, 25, 30]);
14// Output:
15// Length 10: 0.2ms
16// Length 15: 6.4ms     ← growing faster than linear
17// Length 20: 200ms     ← exponential growth confirmed
18// Length 25: 6400ms    ← dangerous!
19 
20// npm install safe-regex — static analysis alternative
21// const safeRegex = require('safe-regex');
22// safeRegex(/(a+)+$/) → false (unsafe)

1// Lookahead: (?=...) asserts what follows WITHOUT consuming characters
2// Lookbehind: (?<=...) asserts what precedes WITHOUT consuming characters
3 
4// Example: find "cat" only when followed by "fish"
5const catfishPattern = /cat(?=fish)/;
6catfishPattern.test('catfish');  // true
7catfishPattern.test('catflap');  // false
8 
9// Negative lookahead: (?!...)
10// Find digits NOT followed by 'px'
11const notPx = /d+(?!px)/;
12 
13// Common mistake: using .* inside lookahead (can be slow)
14const slow = /(?=.*[A-Z])(?=.*[0-9])/; // Fine for short strings, slows on long inputs
15// Better: use anchored pattern for fixed-length password checks
16const fast = /^(?=[^A-Z]*[A-Z])(?=[^0-9]*[0-9])/; // More specific — faster