Skip to content

Comment on Security Checklist

Comments

Are all form fields (with the exception of password fields) validated with a restrictive regex?

Please, whatever you do, do not try to regex validate people's names. A friend couldn't complete an order on a site the other day because it was rejecting his name as "invalid" per its shitty regex.

See also Falsehoods Programmers Believe About Names[1]

[1] http://www.kalzumeus.com/2010/06/17/falsehoods-programmers-b...

<do not try to regex validate people's names>

Or email addresses, without knowing all the legal characters. (An annoying percentage reject '+', which is a great Gmail tool for spotting how your email address "leaks out".)

And a huge number don't suport email addresses with 'bare' tld's.

see rfc 7085 "Top-Level Domains That Are Already Dotless"

https://webcache.googleusercontent.com/search?q=cache:rySaMA...

I thought those weren't allowed / encouraged by either ICANN nor IAB? They have a real-world possibility of colliding with internal hostnames.

In addition, a poorly written Regex can open you up to a Regular Expression DOS attack. If anything, it should be on the security checklist as something not to do.

A friend and I made this for fun. It is a joke and only here for entertainment value, don't put it in production. https://github.com/JonZudell/Genetic_Expression

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.