|
3 | 3 | <p>The complexity of a regular expression is determined as follows:</p>
|
4 | 4 | <p>Each of the following operators increases the complexity by an amount equal to the current nesting level and also increases the current nesting
|
5 | 5 | level by one for its arguments:</p>
|
6 |
| -<ul> |
7 |
| - <li> <code>|</code> - when multiple <code>|</code> operators are used together, the subsequent ones only increase the complexity by 1 </li> |
8 |
| - <li> <code>&&</code> (inside character classes) - when multiple <code>&&</code> operators are used together, the subsequent ones |
9 |
| - only increase the complexity by 1 </li> |
10 |
| - <li> Quantifiers (<code>*</code>, <code>+</code>, <code>?</code>, <code>{n,m}</code>, <code>{n,}</code> or <code>{n}</code>) </li> |
11 |
| - <li> Non-capturing groups that set flags (such as <code>(?i:some_pattern)</code> or <code>(?i)some_pattern</code>) </li> |
12 |
| - <li> Lookahead and lookbehind assertions </li> |
13 |
| -</ul> |
14 |
| -<p>Additionally, each use of the following features increase the complexity by 1 regardless of nesting:</p> |
15 |
| -<ul> |
16 |
| - <li> character classes </li> |
17 |
| - <li> back references </li> |
18 |
| -</ul> |
19 |
| -<p>If a regular expression is split among multiple variables, the complexity is calculated for each variable individually, not for the whole regular |
20 |
| -expression. If a regular expression is split over multiple lines, each line is treated individually if it is accompanied by a comment (either a Java |
21 |
| -comment or a comment within the regular expression), otherwise the regular expression is analyzed as a whole.</p> |
22 |
| -<h2>Noncompliant Code Example</h2> |
23 |
| -<pre> |
24 |
| -if (dateString.matches("^(?:(?:31(\\/|-|\\.)(?:0?[13578]|1[02]))\\1|(?:(?:29|30)(\\/|-|\\.)(?:0?[13-9]|1[0-2])\\2))(?:(?:1[6-9]|[2-9]\\d)?\\d{2})$|^(?:29(\\/|-|\\.)0?2\\3(?:(?:(?:1[6-9]|[2-9]\\d)?(?:0[48]|[2468][048]|[13579][26])|(?:(?:16|[2468][048]|[3579][26])00))))$|^(?:0?[1-9]|1\\d|2[0-8])(\\/|-|\\.)(?:(?:0?[1-9])|(?:1[0-2]))\\4(?:(?:1[6-9]|[2-9]\\d)?\\d{2})$")) { |
25 |
| - handleDate(dateString); |
26 |
| -} |
27 |
| -</pre> |
28 |
| -<h2>Compliant Solution</h2> |
29 |
| -<pre> |
30 |
| -if (dateString.matches("^\\d{1,2}([-/.])\\d{1,2}\\1\\d{1,4}$")) { |
31 |
| - String dateParts[] = dateString.split("[-/.]"); |
32 |
| - int day = Integer.parseInt(dateParts[0]); |
33 |
| - int month = Integer.parseInt(dateParts[1]); |
34 |
| - int year = Integer.parseInt(dateParts[2]); |
35 |
| - // Put logic to validate and process the date based on its integer parts here |
36 |
| -} |
37 |
| -</pre> |
38 |
| -<h2>Exceptions</h2> |
39 |
| -<p>Regular expressions are only analyzed if all parts of the regular expression are either string literals, effectively final local variables or |
40 |
| -<code>static final</code> fields, all of which can be combined using the '<code>+</code>' operator.</p> |
41 |
| -<p>When a regular expression is split among multiple variables or commented lines, each part is only analyzed if it is syntactically valid by |
42 |
| -itself.</p> |
43 | 6 | <ul>
|
44 | 7 | <li> <code>|</code> - when multiple <code>|</code> operators are used together, the subsequent ones only increase the complexity by 1 </li>
|
45 | 8 | <li> Quantifiers (<code>*</code>, <code>+</code>, <code>?</code>, <code>{n,m}</code>, <code>{n,}</code> or <code>{n}</code>) </li>
|
|
0 commit comments