Question

so i would like to expose regular expression queries on a field in my model, such that user could ask for

http://localhost:3000/myview.json?field=^hello, (there|world).*

so i know i’ll have to change my routes to recognise the wildcard characters etc, and i can easily do a Regexp.new() inside my controller to convert this to a real regular expression (i’m using mongomapper in the back).

the issue is the potentially huge security hole with XSS.

should i be worried about this? how could i safely enable users to query with regular expression strings.

(i’m not too bothered about the user hammering the database… yet)

Answer 1

Regular expressions won’t be able to perform arbitrary code execution unless there is something really wrong with Regexp.new. So if we assume that Regexp.new will either make a valid regular expression or fail or do something else sane you are safe already without having to sanitize the incoming string.