Regex Tutorial: Learn Regular Expressions Step by Step (2026)

// * — zero or more (greedy)
/go*gle/.test("ggle")   // true (0 o's)
/go*gle/.test("google") // true (2 o's)
/go*gle/.test("gooogle") // true (3 o's)

// + — one or more (greedy)
/go+gle/.test("ggle")   // false (needs at least 1 o)
/go+gle/.test("google") // true

// ? — zero or one (optional)
/colou?r/.test("color")  // true (u is optional)
/colou?r/.test("colour") // true

// {n} — exactly n times
/\d{4}/.test("2026") // true — exactly 4 digits

// {n,m} — between n and m times (inclusive)
/\w{2,5}/.test("hi")      // true (2 chars)
/\w{2,5}/.test("hello")   // true (5 chars)
/\w{2,5}/.test("a")       // false (1 char)
/\w{2,5}/.test("toolong") // true — matches first 5 chars ("toolo")

// {n,} — n or more times
/\d{3,}/.test("12")    // false (only 2 digits)
/\d{3,}/.test("12345") // true

const html = '<b>bold</b> and <em>italic</em>'

// Greedy: <.*> matches from first < to LAST >
html.match(/<.*>/)
// → ['<b>bold</b> and <em>italic</em>']
// The .* consumed everything between the first and LAST angle bracket

// Lazy: <.*?> matches from < to the NEAREST >
html.match(/<.*?>/g)
// → ['<b>', '</b>', '<em>', '</em>']

// Better solution: character class negation (no backtracking risk)
html.match(/<[^>]+>/g)
// → ['<b>', '</b>', '<em>', '</em>']
// [^>]+ means "one or more chars that are NOT >"
// This is preferred because it has no backtracking ambiguity

// Quantifier lazy variants:
// *?   →  *  with lazy matching
// +?   →  +  with lazy matching
// ??   →  ?  with lazy matching
// {n,m}? → {n,m} with lazy matching

// Capturing group: (pattern)
// Captures are accessible at result[1], result[2], etc.
const dateStr = '2026-04-15'
const match = dateStr.match(/(\d{4})-(\d{2})-(\d{2})/)
// match[0] = '2026-04-15'  (full match)
// match[1] = '2026'        (capture group 1)
// match[2] = '04'          (capture group 2)
// match[3] = '15'          (capture group 3)

// Non-capturing group: (?:pattern)
// Groups without capturing — use for alternation without polluting capture indices
const version = '3.14.159'
const semver = version.match(/(?:\d+\.){2}\d+/)
// Groups without creating match[1], match[2]

// Named capturing group: (?<name>pattern) — ES2018+
const namedMatch = dateStr.match(/(?<year>\d{4})-(?<month>\d{2})-(?<day>\d{2})/)
const { year, month, day } = namedMatch.groups
// year  = '2026'
// month = '04'
// day   = '15'

// Named groups in replacement strings
'2026-04-15'.replace(
  /(?<year>\d{4})-(?<month>\d{2})-(?<day>\d{2})/,
  '$<month>/$<day>/$<year>'
)
// → '04/15/2026'

// Backreference to named group in the same pattern
// Match repeated words: "the the" or "a a"
/\b(?<word>\w+)\s+\k<word>\b/i.test('the the')  // true
/\b(?<word>\w+)\s+\k<word>\b/i.test('the The')  // true (i flag)
/\b(?<word>\w+)\s+\k<word>\b/i.test('the cat')  // false

// Positive lookahead: (?=pattern)
// "match X only if followed by Y" — Y is not part of the match

// Extract version numbers from "v1.2.3" format
'Release v1.2.3 is ready'.match(/\d+\.\d+\.\d+(?= is ready)/)
// → ['1.2.3']  (the " is ready" is not captured)

// Password validation: at least one digit
/^(?=.*\d).{8,}$/.test('password1')  // true
/^(?=.*\d).{8,}$/.test('password')   // false (no digit)

// Negative lookahead: (?!pattern)
// "match X only if NOT followed by Y"

// Match "foo" not followed by "bar"
'foobar foobaz fooqux'.match(/foo(?!bar)\w*/g)
// → ['foobaz', 'fooqux']  ('foobar' excluded)

// Positive lookbehind: (?<=pattern) — ES2018+
// "match X only if preceded by Y"

// Extract dollar amounts after "$"
'Price: $42.00, Cost: $15'.match(/(?<=\$)\d+\.?\d*/g)
// → ['42.00', '15']

// Negative lookbehind: (?<!pattern) — ES2018+
// "match X only if NOT preceded by Y"

// Match numbers not preceded by "$"
'Buy $5 and save 10 dollars'.match(/(?<!\$)\b\d+\b/g)
// → ['10']  (the '$5' is excluded)

// Note: Lookbehind was added in ES2018 (V8 6.2+, Node.js 9.11.2+)
// Go's RE2 does NOT support lookahead or lookbehind
// Python's re module supports lookahead/lookbehind

// /g makes exec() stateful — it remembers where it left off via lastIndex
const re = /\d+/g  // stored in a variable — gets reused

re.exec('42 and 100')  // { 0: '42',  index: 0 }, re.lastIndex = 2
re.exec('42 and 100')  // { 0: '100', index: 7 }, re.lastIndex = 10
re.exec('42 and 100')  // null (no more matches), re.lastIndex = 0

// BUG: if you call exec on a different string, lastIndex is still set
const re2 = /\w+/g
re2.exec('hello world')  // { 0: 'hello', index: 0 }, lastIndex = 5
re2.exec('abc')          // { 0: 'bc', index: 1 } ← WRONG! started at 5, wrapped
// This is why regex with /g in module scope causes hard-to-reproduce bugs

// Solution 1: Create a new regex each call (avoid regex literal in module scope)
function findAll(str) {
  return [...str.matchAll(/\d+/g)]  // matchAll always creates fresh iterator
}

// Solution 2: Reset lastIndex manually
const reGlobal = /\d+/g
function safeExec(str) {
  reGlobal.lastIndex = 0  // reset before use
  return reGlobal.exec(str)
}

// (a+)+ is the canonical ReDoS example
// For input "aaaaaaaaac" (n 'a's then 'c'):
// The engine tries EVERY way to partition n 'a's into groups of one or more
// This is 2^(n-1) partitions — exponential in n

const vulnerable = /(a+)+/
const payload = 'a'.repeat(30) + 'c'  // 30 a's then 'c'

// DON'T RUN THIS — it will hang your process
// console.time(); vulnerable.test(payload); console.timeEnd()

// Patterns with ReDoS risk:
// (a|a)+   — alternation between identical patterns + outer quantifier
// (a*)*    — nested quantifiers
// \w+\s*;  — at line end without anchor (in certain contexts)

// Real-world vulnerable pattern from CVE-2022-25883 (semver npm package):
// /^\s*(\d+\.\d+\.\d+)\s*$/ — NOT vulnerable
// /^(\s+|\s*,\s*)*$/         — POTENTIALLY vulnerable

// Safe alternatives:
// 1. Use possessive quantifiers if your engine supports them (PCRE/Java)
//    (a++)+ — does not backtrack within the group
// 2. Use atomic groups: (?>a+)+
// 3. Use Go's RE2 — linear time, no backtracking
// 4. Validate with the 'safe-regex' npm package
// 5. Set regex timeout limits at the gateway level

// Option 1: node-re2 — RE2 engine for Node.js, O(n) guaranteed
import RE2 from 're2'

const re = new RE2('(a+)+')  // RE2 rejects patterns it can't guarantee-safe
// RE2 throws: "Invalid argument (re2): parentheses not balanced: (a+)+"
// Or silently converts to safe equivalent in some versions

// Option 2: safe-regex package — static analysis
import safeRegex from 'safe-regex'
safeRegex(/(a+)+/)    // false — flagged as potentially catastrophic
safeRegex(/\d+/)      // true — simple, linear

// Option 3: regex-timeout — wraps regex with a time limit
// When user-supplied patterns are evaluated (e.g., search feature),
// always use a timeout wrapper or compile in a Worker with a kill timer

// Option 4: Pattern design — avoid nested quantifiers on same chars
// RISKY: (\w+\s*)+
// SAFE:  \w+(\s+\w+)*   — same semantic, no ambiguity in partition

// Semantic version (semver: major.minor.patch, optional pre-release)
const SEMVER = /^(?<major>0|[1-9]\d*)\.(?<minor>0|[1-9]\d*)\.(?<patch>0|[1-9]\d*)(?:-(?<prerelease>[\w.-]+))?$/
SEMVER.test('1.0.0')        // true
SEMVER.test('2.1.0-beta.1') // true
SEMVER.test('1.01.0')       // false (leading zero)

// ISO 8601 date (basic — not exhaustive)
const ISO_DATE = /^\d{4}-(0[1-9]|1[0-2])-(0[1-9]|[12]\d|3[01])$/
ISO_DATE.test('2026-04-15') // true
ISO_DATE.test('2026-13-01') // false (month 13)
ISO_DATE.test('2026-04-32') // false (day 32)

// IPv4 address (validates 0–255 range)
const IPV4 = /^(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?)$/
IPV4.test('192.168.1.1')  // true
IPV4.test('256.0.0.1')    // false

// Slugify: URL-safe lowercase string
function slugify(str) {
  return str
    .toLowerCase()
    .replace(/[^\w\s-]/g, '')  // remove non-word, non-space, non-hyphen
    .replace(/[\s_]+/g, '-')   // spaces and underscores → hyphens
    .replace(/--+/g, '-')       // collapse multiple hyphens
    .replace(/^-|-$/g, '')      // trim leading/trailing hyphens
}
slugify('Hello, World! How Are You?')  // 'hello-world-how-are-you'

// Extract all log timestamps (format: [2026-04-15 14:30:00.123])
const LOG_TIMESTAMP = /\[(?<ts>\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}\.\d{3})\]/g
const logLine = '[2026-04-15 14:30:00.123] ERROR: connection refused'
const tsMatch = LOG_TIMESTAMP.exec(logLine)
// tsMatch.groups.ts = '2026-04-15 14:30:00.123'

// Remove HTML tags (safe for simple stripping — use DOMParser for complex HTML)
const stripTags = (html) => html.replace(/<[^>]+>/g, '')
stripTags('<p>Hello <strong>world</strong></p>')  // 'Hello world'