Regex Generator & Tester: Tested Against Your Real Strings
Don't guess regex patterns or paste untested ChatGPT output into production. Regex-Gen-Tester writes the pattern, evaluates it on your sample strings in real time, breaks down capture groups, and scans for catastrophic ReDoS backtracking.
Tested Execution Example (REG-LIVE-001)
Here is the actual verified output when requesting an email validator with positive and negative test samples:
User Request to Bot
Write regex for valid work email. Test strings: - alex.smith@company.com - finance@sub.domain.org - plainaddress - @missingusername.com - user@.com.my
Bot Output: Tested Regex & Execution
Pattern: ^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$
Flags: none | Safety: SAFE (Linear O(N) runtime)
Execution Results (5 samples tested):
✓ alex.smith@company.com -> MATCH
✓ finance@sub.domain.org -> MATCH
✗ plainaddress -> NO MATCH (expected)
✗ @missingusername.com -> NO MATCH (expected)
✗ user@.com.my -> NO MATCH (expected)
Summary: 5/5 test assertions passed.
Catastrophic Backtracking (ReDoS) Defense
A bad regex can freeze your NodeJS or Python API at 100% CPU on crafted inputs. The bot automatically identifies dangerous structures:
| Dangerous Pattern | Vulnerability Mechanism | Safe Alternative |
|---|---|---|
(a+)+$ |
Nested one-or-more quantifiers create $2^N$ backtracking paths on non-matching strings. | a+$ (Flatten quantifier) |
([0-9]+)+$ |
Nested character class quantifiers explode CPU on inputs like 123456789! |
[0-9]+$ |
(a|aa)+$ |
Overlapping alternation branches cause exponential tree search. | a+$ |
Engineering Boundaries & Honest Disclaimers
- Structural Validation Only: Regular expressions validate text syntax; they do not perform network lookups or semantic verification. For instance, matching a valid credit card pattern does not verify if the card is active or funded.
- JavaScript V8 Engine: Sample execution runs in standard ECMAScript regex syntax. Named capture groups or lookbehinds may behave differently in older PCRE or POSIX engines.
- Boundaries: Bounded execution limits prevent infinite loops. Patterns exceeding 50ms evaluation time on synthetic strings are aborted.
Frequently Asked Questions
How does the bot test regular expressions?
The bot executes JavaScript RegExp against each provided test sample in an isolated, bounded microtask with reset lastIndex state, returning pass/fail counts and match values.
How does the bot detect ReDoS vulnerabilities?
Static analysis checks for nested unbounded quantifiers like (a+)+ or (.*a)+ that cause polynomial or exponential backtracking, warning the developer before execution.
Does format matching guarantee semantic validity?
No. A regex verifies string structure. It cannot verify whether an email inbox exists, an MX record is live, or an identity is genuine.