Hacker News new | ask | show | jobs
by bink 152 days ago
As a security dude I spend way too much of my time fixing missing anchors or unescaped wildcards in regex. The good news is that it's trivial to detect with static analysis tooling. The bad news is that broken regex is often used for security checks.
2 comments

Sometimes I wish regexes were full matches by default and required prefixing and postfixing with `.*` to get the current behaviour
Java's Pattern.match() method works that way. Python has two separate methods: re.match auto-anchors, re.search does not.
a match isn't boolean, it's substring. the original (and more common) use-cases would become excessively verbose