Regular Expression Crashes in Ruby and Javascript

Question

I have an odd problem occurring with our regex for email addresses. Here is the expression:

^(\w)+(([(\.?)\w\-+])*[\w]+)*@((\[([\d]{1,3}\.){3}[\d]{1,3}\])|((\w)+((\.?)[\w\-]+)*\.[a-z]{2,6}))$

Anything we've thrown at it which matches is fine, the problem is with failures, long strings cause the expression to hang. On our webserver it will spike the CPU. Some examples follow. The problem is when people enter long email addresses errantly, it crashes the server.

This is a failure which works.

rubular failure 1 short@failure

This is a failure which causes the hanging, you can see rubular has issues as well.

rubular failure 2 thisisamuchlonger@expressionleadingtofailure

The interesting thing is if you make it proper:

rubular pass [email protected]

This passes easily.

Edit: A note, I've also attempted to run this using the client side javascript tester and it will fail/succeed in the same ways. There is something about this regex which causes parsers to eat memory and fail, I'm just not sure what part it is.

This is an interesting read regarding this general topic. regular-expressions.info/email.html — Ryanmt
– Ryanmt, Commented Aug 29, 2011 at 19:42
If you cannot rule out your string contains line breaks, you should use \A and \z instead of ^ and $. — michael_wu
– michael_wu, Commented Aug 29, 2011 at 19:51

cam · Accepted Answer · 2011-08-29 19:44:51Z

4

Your regular expression combines the worst-case for regular expressions repeatedly. Your regex gets stuck backtracking over the string when the regex fails to match. Take out the *s and ? s and your regular expression will perform admirably.

See http://swtch.com/~rsc/regexp/regexp1.html for a thorough explanation of why you can't do what you are trying to do in a performant manner.

My personal opinion is that you should just check for /@/ and send a confirmation e-mail, but you can probably find a regex elsewhere on the web that will perform adequately while matching most e-mail addresses.

answered Aug 29, 2011 at 19:44

cam

14.2k1 gold badge46 silver badges29 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Jeremy B. Over a year ago

Thanks for your response, unfortunately we don't have the option of confirmation emails as the system is unmonitored and runs this autonomously. Also we need to account for everything which is allowed under the RFC specifications. We found most rules were too strict.

Matt Over a year ago

@Jeremy you're not really ever validating an e-mail, though. Even an e-mail that passes your RFC-compliant filter can still be an invalid address.

sarvavijJana · Accepted Answer · 2011-08-29 19:47:01Z

1

Try this for example, rubular eats this well

^[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,6}$

By the way google first serp leads to more examples: http://www.regular-expressions.info/email.html

answered Aug 29, 2011 at 19:47

sarvavijJana

1,21211 silver badges11 bronze badges

1 Comment

Jeremy B. Over a year ago

This is a nice start but you lopped off IP addresses.

Collectives™ on Stack Overflow

Regular Expression Crashes in Ruby and Javascript

2 Answers 2

2 Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related