regex matches wrong expressions

Question

I have 2 different strings like

abs1.qwerty.com:1234

and

abs11qwerty.com:1234

After using such regex "(?=" + name + ").*?:(\\\\d+)" , where name is a given string. I receive wrong match, because it assumes they are the same. What can be a solution to such problem?

Answer 1

You need to regex escape name - this is classic injection attack .

If name has regex characters in it the engine will interpret them them as part of the pattern, for example

name = ".*"

will likely match all names, allowing an attacker to extract data from the system.

Use something like the following:

final String pattern = String.format("(?=%s).*?:(\\d+)", Pattern.quote(name))

---

In your example, if the pattern is abs1.qwerty.com the regex engine interprets this is:

• "abs1"- literal
• "." - any character, once
• "qwerty" - literal
• "." - any character, once
• "com" - literal

So the pattern happily matches "abs11qwerty.com".