18 ms·
Not using `document.location.host` stood out to me too. I think the takeaway here is don't use regex unless you absolutely have to and don't use it to parse thi
by K0nserv 10y ago
Not using `document.location.host` stood out to me too. I think the takeaway here is don't use regex unless you absolutely have to and don't use it to parse things that have rigorous standards describing them. Emails, phone numbers, URLs come to mind.
- gorhill 10y ago> don't use it to parse things that have rigorous standards describing them Where a regex must be used, there is a reference regex for parsing URL: https://tools.ietf.org/html/rfc3986#appendix-B https://tools.ietf.org/html/rfc3986#appendix-B Edit: a permalink to demonstrate the above reference regex: https://regex101.com/r/yJ5nU4/1 https://regex101.com/r/yJ5nU4/1 -- would have prevented the LastPass bug.
- sebcat 10y agoI once came across a bug in a codebase I inherited that parsed URI-references from HTML documents. That bug was caused by using that very same regular expression. The string "foo" correctly gets parsed as a path (group 5). However the string "foo;key:value" gets parsed as a "foo;key" scheme (group 1,2) and a "bar" path (group 5) by the regular expression, but as a path if you follow the grammar. scheme = ALPHA *( ALPHA / DIGIT / "+" / "-" / "." ) vs. ^(([^:\/?#]+):)? :; are reserved characters, but they do not need to be encoded when they are a part of the path. So yeah, don't use regular expressions for parsing.