Java正则表达式 - 匹配模式的第一次出现

Question

I'm matching URLs against a regular expression, testing if they reflect a "shutdown" command.

Here's a URL that performs a shutdown:

/exec?debug=true&command=shutdown&f=0

Here's another, legitimate but confusing URL that performs shutdown:

/exec?commando=yes&zcommand=34&command=shutdown&p

Now, I must ensure there's only one command=... parameter and it is command=shutdown . Alternatively, I can live with ensuring the first command=... parameter is command=shutdown .

Here's my test for the requested regular expression:

/exec?version=0.4&command=shutdown&out=JSON&zcommand=1

Should match

/exec?version=0.4&command=startup&out=JSON&zcommand=1&commando=shutdown

Should fail to match

/exec?command=shutdown&out=JSON

Should match

/exec?version=0.4&command=admin&out=JSON&zcommand=1&command=shutdown

Should fail to match

Here's my baseline - a regular expression that passes the above tests - all but the last one:

^/exec?(.*\&)*command=shutdown(\&.*)*$

The problem is with the occurrence of more than one command=..., where the first one is not shutdown.

I tried using lookbehind:

^/exec?(.*\&)*(?<!(\&|\?)command=.*)command=shutdown(\&.*)*$

But I'm getting:

Look-behind group does not have an obvious maximum length near index 31

I even tried atomic grouping. To no avail. I can't make the following expression NOT match:

/exec?version=0.4&command=admin&out=JSON&zcommand=1&command=shutdown

Can anyone help with a regular expression that passes all the tests?

Clarifications

I see I owe you some context.

My task is to configure a Filter that guards the entrance of all our system's servlets, and verifies there's an open HTTP session (in other words: that a successful Login has occurred). The filter also allows configuring which URLs do not require login.

Some exceptions are easy: /login does not need login. Calls to localhost do not need login.

But sometimes it gets complicated. Like the shutdown command that cannot require login while other commands can and should (the strange reason for that is out of the scope of my question).

Since it's a security matter, I can't allow users to merely append &command=shutdown to a URL and bypass the filter.

So I really need a regular expression, or otherwise I'll need to redefine the configuration specs.

Answer 1

You would need to do it in multiple steps:

(1) Find match of ^(?=\\/exec\\?).*?(?<=[?&])command=([^&]+)

(2) Check if match is shutdown

Answer 2

This tested (and fully commented) regex solution meets all your requirements:

import java.util.regex.*;
public class TEST {
    public static void main(String[] args) {
        Pattern re = Pattern.compile(
            "  # Match URI having command=shutdown query variable value. \n" +
            "  ^                          # Anchor to start of string.   \n" +
            "  (?:[^:/?\\#\\s]+:)?        # URI scheme (Optional).       \n" +
            "  (?://[^/?\\#\\s]*)?        # URI authority (Optional).    \n" +
            "  [^?\\#\\s]*                # URI path.                    \n" +
            "  \\?                        # Literal start of URI query.  \n" +
            "    # Match var=value pairs preceding 'command=xxx'.        \n" +
            "  (?:                        # Zero or more 'var=values'    \n" +
            "    (?!command=)             # only if not-'command=xxx'.   \n" +
            "    [^&\\#\\s]*              # Next var=value.              \n" +
            "    &                        # var=value separator.         \n" +
            "  )*                         # Zero or more 'var=values'    \n" +
            "  command=shutdown           # variable and value to match. \n" +
            "    # Match var=value pairs following 'command=shutdown'.   \n" +
            "  (?:                        # Zero or more 'var=values'    \n" +
            "    &                        # var=value separator.         \n" +
            "    (?!command=)             # only if not-'command=xxx'.   \n" +
            "    [^&\\#\\s]*              # Next var=value.              \n" +
            "  )*                         # Zero or more 'var=values'    \n" +
            "  (?:\\#\\S*)?               # URI fragment (Optional).     \n" +
            "  $                          # Anchor to end of string.", 
            Pattern.CASE_INSENSITIVE | Pattern.UNICODE_CASE | Pattern.COMMENTS);
        String s = "/exec?version=0.4&command=shutdown&out=JSON&zcommand=1";
            // Should match
//      String s = "/exec?version=0.4&command=startup&out=JSON&zcommand=1&commando=shutdown";
            // Should fail to match 
//      String s = "/exec?command=shutdown&out=JSON";
            // Should match
//      String s = "/exec?version=0.4&command=admin&out=JSON&zcommand=1&command=shutdown";
        // Should fail to match";
        Matcher m = re.matcher(s);
        if (m.find()) {
            // Successful match
            System.out.print("Match found.\n");
        } else {
            // Match attempt failed
            System.out.print("No match found.\n");
        } 
    }
}

The above regex matches any RFC3986 valid URI having any scheme, authority, path, query or fragment components, but it must have one (and only one) query "command" variable whose value must be exactly, but case insensitively: "shutdown" .

A carefully crafted complex regex is perfectly fine (and maintainable) to use when written with proper indentation and commented steps (like shown above). (For more information on using regex to validate a URI, see my article: Regular Expression URI Validation )

Answer 3

Ok. I thank you all for your great answers! I tried some of the suggestions, struggled with others, and all in all I have to agree that even if the right regex exists, it looks terrible, non maintainable, and can serve well as a nasty university exercise, but not in a real system configuration.

I also realize that since a Filter is involved here, and the Filter already parses its own URI, it is absolutely ridiculous to glue back all the URI parts into a string and match it against a regular expression. What was I thinking??

I'll therefore redesign the Filter and its configuration.

Thanks a lot, people! I appreciate the help :)

Noam Rotem.

PS - why was I getting a userXXXX nick? Very strange...

Answer 4

If you can live with just accepting the first match, you could just use '\\\\Wcommand=([^&]+) and fetch the first group.

Otherwise, you could just call Matcher.find twice to test for subsequent matches, and eventually use the first match, why do you want to do this with a single complex regex?

Answer 5

If this can be done with a single regular expression, and it may well could be; it will be so complex as to be un-readable, and thus un-maintainable as the intent of the logic will be lost. Even if it is "documented" it will still be much less obvious to someone who just knows Java.

Solving problems like this is an abuse of a regular expression as much as driving screws with a hammer is abusing the hammer and the screw both.

A much better approach would be to use the URI object parse the entire thing, domain and all and pull off the query parameters and then write a simple loop that walks through them and decides based on your business logic what is a shutdown and what isn't. Then it will be simple, self-documenting and probably more efficient ( not that that should be a concern ).

Some people, when confronted with a problem, think "I know, I'll use regular expressions." Now they have two problems. -- Jamie Zawinski

Down vote all you want, but the best solution for this specific example is not a regular expression; given the "clarification" even more so.

Especially in a business environment where you have to share code with people, not only working with you now, but an unknown talent pool in the future. The "accepted" answer should never pass a corporate code review. Zawinski's quote applies to this situation exactly!

Answer 6

我不是Java编码器，但尝试这个（在Perl中工作）>>

^(?=\/exec\?)(?:[^&]+(?<![?&]command)=[^&]+&)*(?<=[?&])command=shutdown(?:&|$)

Answer 7

To match the first occurrence of command=shutdown use this:

Pattern.compile("^((?!command=).)+command=shutdown.*$");

The results will look like this:

"/exec?version=0.4&command=shutdown&out=JSON&zcommand=1" => false
"/exec?command=shutdown&out=JSON" => true
"/exec?version=0.4&command=startup&out=JSON&zcommand=1&commando=shutdown" => false
"/exec?commando=yes&zcommand=34&command=shutdown&p" => false

If you want to match strings that ONLY contain one 'command=' use this:

Pattern.compile("^((?!command=).)+command=shutdown((?!command=).)+$");

Please note that using "not" qualifiers in regular expressions is not something they are intended for and performance might not be the best.

Answer 8

Try this:

Pattern p = Pattern.compile(
    "^/exec\\?(?:(?:(?!\\1)command=shutdown()|(?!command=)\\w+(?:=[^&]+)?)(?:&|$))+$\\1");

Or a little more readably:

^/exec\?
(?:
  (?:
    (?!\1)command=shutdown()
    |
    (?!command=)\w+(?:=[^&]+)?
  )
  (?:&|$)
)+$
\1

The main body of the regex is an alternation that matches either a shutdown command or a parameter whose name is not command . If it does match a shutdown command, the empty group in that branch "captures" an empty string. It doesn't need to consume anything, because we're only using it as a checkbox, confirming en passant that one of the parameters was a shutdown command.

The negative lookahead - (?!\\1) - prevents it from matching two or more shutdown commands. I don't know if that's really necessary, but it's a good opportunity to demonstrate (1) how to negate a "back-assertion", and (2) that a backreference can appear before the group it refers to in certain circumstances (what's known as a forward reference ).

When the whole URL has been consumed, the backreference ( \\1 ) acts like a zero-width assertion. If one of the parameters was command=shutdown , the backreference will succeed. Otherwise it will fail even though it's only trying to match an empty string, because the group it refers to didn't participate in the match.

But I have to concur with the other responders: when your regexes get this complicated, you should be thinking seriously about switching to a different approach.

---

EDIT: It works for me. Here's the demo .