AI Regex Tester, Builder & Explainer
Translate natural language to regular expressions, inspect capture groups in real-time, and check for catastrophic ReDoS vulnerabilities.
Regular Expression Pattern
ReDoS Security & Complexity Guard
🛡️ Safe O(N) LinearNo exponential catastrophic backtracking detected. Pattern executes safely in linear O(N) time across web servers.
Extracted Match List
Capture VectorsMulti-Language Code Snippet
import re
pattern = r"[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}"
matches = re.findall(pattern, text, re.IGNORECASE)Click "Run AI Regex Audit" to generate step-by-step token syntax trees, edge case validations, and atomic grouping optimization tips. Your data is 100% private to you—zero server access.
Zero Data Access: All regex matching and text processing happens 100% locally in your browser. Zero Server Access
Preventing a Cloudflare ReDoS Outage: How a Vulnerable Regular Expression Took Down Authentication
A post-mortem engineering analysis of Regular Expression Denial of Service (ReDoS), exponential backtracking, and atomic group refactoring.
The Mechanics of Catastrophic Backtracking
When regular expression engines evaluate nested quantifiers (such as (a+)+$ or ([a-zA-Z]+)*=), matching valid strings is near instantaneous ($O(N)$). However, when provided with a non-matching payload like aaaaaaaaaaaaaaaaaaaaaaaaaaaa!, the engine attempts every mathematical permutation of inner and outer repetitions—spiking to $2^{30}$ (1,073,741,824) operations for just 30 characters, locking the CPU thread at 100%.
The Scenario: The Broken Email Validation Filter
A financial API deployed an authorization gateway using a naive regex to validate incoming customer authorization headers:
Pattern: ^([a-zA-Z0-9]+)+$
Input: 32 'a's + '!'
Execution Time: 8.4 Seconds (Hangs Node.js!)
Pattern: ^[a-zA-Z0-9]+$
Eliminated nested quantifier
Guaranteed linear O(N) evaluation.
Execution Time: 0.001 ms
CPU Utilization: 0.1%
100% Immune to malicious ReDoS attacks.
Regex Engine Dialect Comparison
| Regex Engine / Dialect | Backtracking Model | Lookaround Support | ReDoS Vulnerable? |
|---|---|---|---|
| JavaScript (V8 / ECMAScript) | NFA (Backtracking) | Full Lookahead & Lookbehind | Yes (Needs static analysis) |
Python (Standard re) |
NFA (Backtracking) | Fixed-width lookbehind only | Yes (Unless regex module used) |
Google RE2 / Go regexp |
DFA / Thompson NFA | No Lookarounds | 100% ReDoS Immune (Guaranteed O(N)) |
Golden Rules for Secure Regex Design
Never nest repetition operators like (x+)* or (a|b+)+. When matching unbounded input from external users, always enforce strict character classes, set maximum string length constraints upfront, and test with our ReDoS complexity analyzer before deployment.
Frequently Asked Questions (Regex)
What is Regular Expression Denial of Service (ReDoS)?
ReDoS is a cybersecurity vulnerability where an algorithmic flaw in a regular expression with overlapping nested quantifiers (e.g., (a+)+$) causes the regex engine to execute exponential backtracking (O(2^n)) on malicious inputs, consuming 100% CPU and hanging the application server.
What is the difference between greedy and lazy quantifiers in regex?
Greedy quantifiers (such as .* or .+) match as many characters as possible before checking the next token. Lazy quantifiers (such as .*? or .+?) match as few characters as possible, expanding only when subsequent tokens fail.
How does a lookaround assertion work in regular expressions?
Lookaround assertions (positive lookahead (?=...), negative lookahead (?!...), positive lookbehind (?<=...), and negative lookbehind (?