Regular Expressions: Powerful but Dangerous

Regular expressions (regex) describe search patterns using a compact syntax. A pattern like \b\d3-\d4\b matches phone number fragments (e.g., 555-1234) in any text. Regex power comes from quantifiers (*, +, ?), character classes (\d, \w, \s), anchors (^, $), and groups — together, these can match virtually any text pattern. The tradeoff is readability: even experienced developers struggle to parse complex regex, which is why testing tools are essential.

Capture Groups and Backreferences

Parentheses in regex serve two purposes: grouping (for applying quantifiers to a sequence) and capturing (for extracting matched substrings). In the pattern (\d4)-(\d2)-(\d2), group 1 captures the year, group 2 the month, group 3 the day. Named groups ((?<year>\d4)) make code more readable. Non-capturing groups ((?:...)) group without capturing, which is slightly more performant when you do not need the matched substring.

ReDoS: When Regex Becomes a Security Risk

Catastrophic backtracking occurs when a regex engine explores exponentially many paths on certain inputs. The pattern (a+)+$ applied to "aaaaaaaaaaaaaaaaab" can take seconds or minutes because the engine tries every possible way to divide the a's between the inner and outer groups before failing. This is exploitable as a ReDoS (Regular Expression Denial of Service) attack. Avoid nested quantifiers on overlapping patterns, and use tools that detect vulnerable patterns before deploying regex to production.