Question

I have a JSP redemption for XSS attacks, in which it checks if the content matches a regular expression to determine whether it is safe or not, here is the code:

String contents = bodyContent.getString();
String regExp = new String("^\\w{5,25}$");
// Do a regex to find the good stuff
if (contents.matches(regExp)) {
     //write the original content
}else{
     //change content to make it safe and write it
}

My question is about the regular expression “^\w{5,25}$”, which you can see it here visually. Why matching this regular expression shows safety?

Answer 1

If the regular expression was:

 ^\w{5,25}$

then this would limit the string to letters, numbers and underscores – i.e. no spaces or other punctuation. This means that it cannot be a nefarious script as that would surely include spaces, or semi-colons.