Validation7 chars

Regex with Nested Quantifiers

This is a teaching pattern for catastrophic backtracking risk. It looks simple, but nested quantifiers can turn certain non-matching inputs into expensive regex evaluations.

The expression

/^(a+)+$/

How to read it

Anchor: the match must start at the beginning of the string.

Anchor: the match must run to the end of the string.

Nested quantifiers — the shape behind catastrophic backtracking.

Do not run this on untrusted input

This expression contains nested quantifiers, so an input that nearly matches can force the engine through an exponential number of attempts before it fails. On a public endpoint that is a denial-of-service vector. Rewrite it with a possessive or atomic construct, cap the input length, or validate with a parser instead.

Validate your own text, line by line

no input

Try:

This expression is anchored, so it asks whether a whole string is valid. Each line above is tested on its own — it will not find a match inside a longer sentence.

Examples, checked in your browser

4/4 verified

aaaa

Simple repeated input matches.

aaaaaaaaaaaaaaaa!

A trailing non-match is where backtracking cost spikes.

No match — this is the kind of input the pattern rejects.

(empty string)

No match — this is the kind of input the pattern rejects.

Use it in code

3 languages

JavaScript

const regex = /^(a+)+$/g;
regex.test(input);

Python

import re
pattern = re.compile(r"^(a+)+$")
bool(pattern.search(input))

re := regexp.MustCompile("^(a+)+$")
matched := re.MatchString(input)

Flagsnone

Examples4

SafetyRisk

Regex with Nested Quantifiers

The expression

How to read it

Do not run this on untrusted input

Validate your own text, line by line

Examples, checked in your browser

Use it in code

Other validation patterns

Valid Email Address

URL Slug

Strong Password

UUID v4

IPv4 Address

Hex Color