4

I've been using this:

str2 = str1.replace(/[^\w]/gi, '');

It works fine, but falls foul of JSLint for having an insecure '^' as outlined in the posts here and here.

The consensus is that it is better to use your regex to specify what is allowed rather than what is not. No one ever demonstrates how to do this, however. I've even got Flanagan and Crockford in front of me here, but to my shame I'm still not sure what to do.

So... how do you set str2 to only allow the \w characters found in str1 using a positive test rather than a negative one?

Community
  • 1
  • 1
Nick
  • 5,995
  • 12
  • 54
  • 78
  • Do you want to extract the safe characters from str1? – nhahtdh Jun 30 '12 at 04:54
  • You can use the solution provided by Zim. The example is too simple to give a good demonstration of the point of not using `^`. – nhahtdh Jun 30 '12 at 04:59
  • Yes, @nhahtdh, Zim's solution is great for this simple case. I'd be interested to know how it works for more complex ones, though. – Nick Jun 30 '12 at 05:10

3 Answers3

2

Try with \W (capital W).

The \w selects word, while \W selects not word. And looks a bit nicer in the expression.

Here's a RegEx cheatsheet, it comes handy while you're coding!

Enrico
  • 766
  • 8
  • 19
  • By the way, your code would look like: `str2 = str1.replace(/[\W]/gi, '');` – Enrico Jun 30 '12 at 04:54
  • Yes, this works well - `\W` is a handy trick. I'd still like to know how to do it for more complex cases, though :) – Nick Jun 30 '12 at 05:11
  • Can you mention an example? Maybe if you tell us what you're trying to filter/match we can help you – Enrico Jun 30 '12 at 13:46
  • You have helped me with the specific example I was working with. The solution, however, replaces a 'not word' character with a blank which is a blacklist approach by stealth. What if you wanted to allow word characters, asterisks and hash signs, for example? – Nick Jul 01 '12 at 01:57
  • @Nick: You can actually do `inputString.match(/pattern/g).join("")`. This is a valid but not very good example. Good example involves whitelist regex that is complex enough for people to be lazy and use the black list approach - or they simply don't know to full extent what they want to keep. I actually want to see one myself, though. – nhahtdh Jul 01 '12 at 02:14
1

Your example is too simple to demonstrate the point of not using ^ in regex.

A better example can be: HTML code clean up in a form submit, where you want to allow HTML tags, but don't want people to inject XSS (Cross-Site Scripting) attack. In this case, if you use blacklist approach, you cannot reliably remove all attack codes, since the attacker can alter the syntax to avoid your filter - or adapt the code so that the filtered code will give back the attack code. The correct approach is to use a white-list and list out all the tags allowed, plus allowed attributed. This example may not related to regex - since regex should not be used to parse HTML, but it demonstrate the point about white-list versus black-list approach in filtering.

nhahtdh
  • 55,989
  • 15
  • 126
  • 162
  • Thanks for this. My question is, however, how do you *implement* the white-list approach? Everyone recommends this method, but no one seems to want to demonstrate it :) – Nick Jun 30 '12 at 05:40
  • @Nick: Some example of whitelist validation: https://www.owasp.org/index.php/Input_Validation_Cheat_Sheet I don't know if there is any good example of extracting whitelist-ed tokens. If the string failed validation, usually it is thrown away (for HTML, clean up is usually done by parser based on the data structure - regex is not involved much). – nhahtdh Jun 30 '12 at 07:03
  • Yes, I can see how to do the regex.test() and then discard failed strings. It's the purging move I'm curious about where you're left with the original string minus any offensive elements but with a whitelist approach. – Nick Jul 01 '12 at 02:02
0

It depends on what you want to do.

You can either only allow the \w charset and throw an error when the string contains characters other than those in the \w charset, by doing something like this:

str1='blah blah string';
if(str1.match(/^\w*$/gi)
{
    //do something
}
else
{
    //alert and/or throw error
}

Or you can accept whatever is being defined as str1 and filter out the characters that you don't want. Which is what you are currently doing. Example:

str1='blah blah some string';
str1=str1.replace(/\W/gi,'');

Note: the above is a shorter version of what you are doing. str2 = str1.replace(/[^\w]/gi, '');

bluegman991
  • 707
  • 4
  • 9