npm.io
0.2.0 • Published 1 week ago

@ifc-lite/regex-guard

Licence
MPL-2.0
Version
0.2.0
Deps
0
Size
17 kB
Vulns
0
Weekly
0
Stars
381

@ifc-lite/regex-guard

Dependency-free validation for regular-expression patterns supplied by users or model files. Shared by IFC pattern-validation and editing tools.

Usage

import { compileGuardedRegex } from '@ifc-lite/regex-guard';

const pattern = compileGuardedRegex('^Wall-[0-9]+

compileGuardedRegex(pattern, flags?, { maxLength? }?) validates the pattern before constructing a JavaScript RegExp. Rejected patterns throw UnsafeRegexPatternError, which exposes pattern and reason. A malformed pattern that passes the guard can still throw the native SyntaxError.

Other exports:

  • assertGuardedRegexPattern(pattern, { maxLength? }?): validate without compiling.
  • hasCatastrophicBacktrackingShape(pattern): detect the nested-quantifier shapes covered by the heuristic.
  • MAX_GUARDED_REGEX_PATTERN_LENGTH: the default limit of 256 characters.

Limits

This is a heuristic, not a guarantee of bounded execution time. It rejects known nested-quantifier patterns such as (a+)+ and caps pattern length, but it does not analyze every possible backtracking shape. It does not move matches to a worker, enforce a match timeout, or replace JavaScript's regex engine.

License

MPL-2.0.

, 'i'); console.log(pattern.test('Wall-42')); // true

__INLINE_CODE_0__ validates the pattern before constructing a JavaScript __INLINE_CODE_1__. Rejected patterns throw __INLINE_CODE_2__, which exposes __INLINE_CODE_3__ and __INLINE_CODE_4__. A malformed pattern that passes the guard can still throw the native __INLINE_CODE_5__.

Other exports:

  • __INLINE_CODE_6__: validate without compiling.
  • __INLINE_CODE_7__: detect the nested-quantifier shapes covered by the heuristic.
  • __INLINE_CODE_8__: the default limit of 256 characters.

Limits

This is a heuristic, not a guarantee of bounded execution time. It rejects known nested-quantifier patterns such as __INLINE_CODE_9__ and caps pattern length, but it does not analyze every possible backtracking shape. It does not move matches to a worker, enforce a match timeout, or replace JavaScript's regex engine.

License

MPL-2.0.

Keywords