|
3 | 3 | <p>The complexity of a regular expression is determined as follows:</p> |
4 | 4 | <p>Each of the following operators increases the complexity by an amount equal to the current nesting level and also increases the current nesting |
5 | 5 | level by one for its arguments:</p> |
6 | | -<ul> |
7 | | - <li> <code>|</code> - when multiple <code>|</code> operators are used together, the subsequent ones only increase the complexity by 1 </li> |
8 | | - <li> <code>&&</code> (inside character classes) - when multiple <code>&&</code> operators are used together, the subsequent ones |
9 | | - only increase the complexity by 1 </li> |
10 | | - <li> Quantifiers (<code>*</code>, <code>+</code>, <code>?</code>, <code>{n,m}</code>, <code>{n,}</code> or <code>{n}</code>) </li> |
11 | | - <li> Non-capturing groups that set flags (such as <code>(?i:some_pattern)</code> or <code>(?i)some_pattern</code>) </li> |
12 | | - <li> Lookahead and lookbehind assertions </li> |
13 | | -</ul> |
14 | | -<p>Additionally, each use of the following features increase the complexity by 1 regardless of nesting:</p> |
15 | | -<ul> |
16 | | - <li> character classes </li> |
17 | | - <li> back references </li> |
18 | | -</ul> |
19 | | -<p>If a regular expression is split among multiple variables, the complexity is calculated for each variable individually, not for the whole regular |
20 | | -expression. If a regular expression is split over multiple lines, each line is treated individually if it is accompanied by a comment (either a Java |
21 | | -comment or a comment within the regular expression), otherwise the regular expression is analyzed as a whole.</p> |
22 | | -<h2>Noncompliant Code Example</h2> |
23 | | -<pre> |
24 | | -if (dateString.matches("^(?:(?:31(\\/|-|\\.)(?:0?[13578]|1[02]))\\1|(?:(?:29|30)(\\/|-|\\.)(?:0?[13-9]|1[0-2])\\2))(?:(?:1[6-9]|[2-9]\\d)?\\d{2})$|^(?:29(\\/|-|\\.)0?2\\3(?:(?:(?:1[6-9]|[2-9]\\d)?(?:0[48]|[2468][048]|[13579][26])|(?:(?:16|[2468][048]|[3579][26])00))))$|^(?:0?[1-9]|1\\d|2[0-8])(\\/|-|\\.)(?:(?:0?[1-9])|(?:1[0-2]))\\4(?:(?:1[6-9]|[2-9]\\d)?\\d{2})$")) { |
25 | | - handleDate(dateString); |
26 | | -} |
27 | | -</pre> |
28 | | -<h2>Compliant Solution</h2> |
29 | | -<pre> |
30 | | -if (dateString.matches("^\\d{1,2}([-/.])\\d{1,2}\\1\\d{1,4}$")) { |
31 | | - String dateParts[] = dateString.split("[-/.]"); |
32 | | - int day = Integer.parseInt(dateParts[0]); |
33 | | - int month = Integer.parseInt(dateParts[1]); |
34 | | - int year = Integer.parseInt(dateParts[2]); |
35 | | - // Put logic to validate and process the date based on its integer parts here |
36 | | -} |
37 | | -</pre> |
38 | | -<h2>Exceptions</h2> |
39 | | -<p>Regular expressions are only analyzed if all parts of the regular expression are either string literals, effectively final local variables or |
40 | | -<code>static final</code> fields, all of which can be combined using the '<code>+</code>' operator.</p> |
41 | | -<p>When a regular expression is split among multiple variables or commented lines, each part is only analyzed if it is syntactically valid by |
42 | | -itself.</p> |
43 | 6 | <ul> |
44 | 7 | <li> <code>|</code> - when multiple <code>|</code> operators are used together, the subsequent ones only increase the complexity by 1 </li> |
45 | 8 | <li> Quantifiers (<code>*</code>, <code>+</code>, <code>?</code>, <code>{n,m}</code>, <code>{n,}</code> or <code>{n}</code>) </li> |
|
0 commit comments