CODEWITHSUNDEEP
javascriptregexjslintregex-negation
Thomas R
Thomas R

Reputation: 3036

JSLint "insecure ^" in regular expression

JSLint reports Insecure '^' for the following line. Why is that? Or is it just going to complain any time I want to negate a character class?

// remove all non alphanumeric, comma and dash characters
"!$7s-gd,&j5d-a#".replace(/[^\w,\-]/g, '');

Upvotes: 43

Views: 17329

Answers (3)

David Morrow
David Morrow

Reputation: 9354

regexp: true

in your lint options, will allow

. and [^...] in /RegExp/

you can configure the rules you would like to use here

http://www.jslint.com/

Upvotes: 6

dugokontov
dugokontov

Reputation: 4612

Consider using \W instead of /^\w/

"!$7s-gd,&j5d-a#".replace(/\W/g, '');

For your particular case this would not work because you want to leave comma and dash characters, but I think it is worth mentioning.

Upvotes: 0

Nick Craver
Nick Craver

Reputation: 630569

It only will do this if you have the option selected at the bottom: 

Disallow insecure . and [^...] in /RegExp/

From the docs:

true if . and [^...] should not be allowed in RegExp literals. These forms should not be used when validating in secure applications.

So the answer your question, if you start a regex with ^ and it's checked, yes it'll throw the error every time. The issue is with unicode characters, you're allowing pretty much anything in there and there's potential for security issues, or validation bypassing issues. Instead of disallowing something (which can be bypassed), allow only what characters are valid.

Upvotes: 38

Related Questions