1

JavaScript: The Good Parts p41 contains the following regex:

/&([^&;]+);/g

which is used to find all HTML entities such as >. If one validates this code with JSLint it reports

Insecure '^'

While this is correct strictly speaking, I still believe it's fine to ignore it. Or not?

7
  • 3
    Shouldn't it be /&([^&;]+?);/g ?
    – rausch
    Feb 8, 2013 at 9:17
  • You're going to need a {1,10} or something before your regular expression works - at the moment it won't match > (but would match &g;). Feb 8, 2013 at 9:18
  • 1
    @RichieHindle No, _rausch is right. It should be lazy match. Besides the question is not about this.
    – VisioN
    Feb 8, 2013 at 9:19
  • @rausch, you're right - almost. I forgot a '+'. There is '+' in the code sample in Crockford's book. Ohh, someone just edited my post to fix this, thanks. Feb 8, 2013 at 9:40
  • @SalmanA, I do know what JSLint wants to tell me. If I had to rewrite the regex to avoid '^' I'd essentially have to list all characters actually found in HTML entities. Which is impractical in my opinion. Feb 8, 2013 at 9:47

2 Answers 2

3

It's warning that the regular expression might match more than expected, and it is correct to warn about it; it will match things like this “&abc def ghi;” despite them being illegal entity names. On the other hand, it is probably not a serious problem in this case (though it strictly depends on what you do after matching); you can disable it in JSLint easily enough.

A better RE would be:

/&(#[0-9]+|#[xX][a-fA-F0-9]+|[a-zA-Z0-9]+);/

I can't remember what other characters are permitted in entity names, alas.

2

To offer an answer to the actual question. If you know why it is insecure and are okay with it, ignore it. If you are annoyed by JSLint complaining, fix it. ;)

I would consider it secure enough.

Not the answer you're looking for? Browse other questions tagged or ask your own question.