DB.
Courses

Bypassing REGEX Restrictions
OSWE · Chapter 14

Bypassing REGEX Restrictions

Regex-based input filters are a common but fragile defense — a poorly written pattern can be bypassed with edge cases the author never considered: alternate encodings, newline handling differences, or catastrophic backtracking.

Key concepts

  • Anchoring mistakes (forgetting `^`/`$`, or using `.` instead of an explicit allow-listed character class) let malicious input slip through what looks like a strict filter.
  • Multiline mode and different regex engines handle `.` and `$` differently around newlines — a filter tested against one engine can behave differently in production.
  • Regular expressions built from untrusted input (rather than as fixed patterns) risk ReDoS (catastrophic backtracking) as well as injection into the pattern itself.
  • Regex filtering should always be paired with allow-list validation and proper output encoding — never treated as the sole defense for a security-sensitive input.

Example

// Naive filter, bypassable with a newline
const blocked = /^admin$/;
blocked.test("admin\nextra"); // may still match depending on flags/engine

Try it yourself

Take a simple regex-based filter (e.g. blocking the literal word "admin") and test it against inputs with different casing, embedded newlines, and Unicode look-alike characters to see which bypasses succeed.

ReferenceSearch video walkthroughs

@ Daniel Burlacu