...
- match flags used in non-capturing groups (These override matching options that may or may not have been passed into the
compile()method.) - greediness (where the regular expression tries to match as much of the string as possible, which may expose too much information)
- grouping (where the programmer can define certain smaller parts of the regular expression to capture and return, but a malicious user may be able to use to make his own groupings)
| Wiki Markup |
|---|
For introductory information on regular expressions, |
see \[[Tutorials 08|AA. Java References#Tutorials 08]\]. |
Noncompliant Code Example
...
Violating this guideline may result in sensitive information disclosure.
References
| Wiki Markup |
|---|
\[[Tutorials 08|AA. Java References#Tutorials 08]\] [Regular Expressions|http://java.sun.com/docs/books/tutorial/essential/regex/index.html]
\[[MITRE 09|AA. Java References#MITRE 09]\] [CWE ID 625|http://cwe.mitre.org/data/definitions/625.html] "Permissive Regular Expressions"
\[[CVE 05|AA. Java References#CVE]\] [CVE-2005-1949|http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1949] |