Re: RegExp irregularity in JScript

From: Steve Fulton (cerberus40_at_hotmail.com)
Date: 03/05/04 

Date: Fri, 5 Mar 2004 08:00:00 -0500

Bryan Donaldson wrote:
> For exampe, a password-validating pattern such as (has to be between 4 and 8
> characters, containing at least digit, one lower case and one upper case
> letter) would be
> ^(?=.*\d)(?=.*[a-z])(?=.*[A-Z]).{4,8}$
>
> Now, when we use the test value
>
> Expression : aA1234 we get a successful match.
>
> Expression : aA123 is NOT a match (by the logic above).
>
> Expression : 1234aA is NOT a match..
>
> Do you have any pointers on where we've messed up?

>From changing the minimum number of characters in the ".{4,8}" portion of the
pattern, it looks like the regular expression succeeds only if the *last class*
of characters (i.e. digits, lower case, upper case) in the string is at least 4
characters long. All three strings match if the pattern is ".{1,8}"; the first
two pass if it's ".{3,8}". What makes this behavior puzzling is if you capture
the pattern as a submatch (e.g. "(.{1,8})") the entire string is returned, not
just the end of the string!

This looks like a bug in Microsoft's regular expression implementation (it fails
in VBScript as well). I'd tell them about it but they've halted development of
ActiveX scripting, and since this isn't a security issue I doubt a fix will be
forthcoming. 

-- 
Steve
Rise above principal and do what's right. -Joseph Heller
Loading