The silent failure problem with regex
Most code errors announce themselves — a null reference, a type mismatch, a failed build. Regex errors are silent. A pattern that is slightly wrong may match 99% of inputs correctly and fail only on edge cases: international phone formats, email addresses with plus signs, URLs with query strings. These cases show up from real users in production, not in unit tests written by the developer who designed the pattern.
I wrote about a specific case in How I Test Regex Before It Breaks Production — a phone validator that silently rejected every Moroccan number (+212XXXXXXXXX) for two months because the length range was off by one. The fix was one character. The tool here would have caught it in 30 seconds if I'd tested the edge case before shipping.
The three test categories every regex needs
Before shipping any regex, test three categories of strings — not just strings you expect to match:
- Happy path5–10 strings that should match. If any fail, the pattern is wrong.
- Rejection casesStrings that should NOT match. If any slip through, the pattern is too permissive.
- Edge casesStrings that could go either way — decide your intent first, then verify the pattern behaves accordingly. This is where most bugs hide.
Also test for catastrophic backtracking: nested quantifiers like (a+)+ can cause exponential slowdown on certain inputs. Paste a 50-character string that partially matches but ultimately fails — if the match takes more than 100 ms, you have a ReDoS vulnerability.
The flags that change behavior in non-obvious ways
- m (multiline)Makes
^and$match the start/end of each line, not the whole string. A validator with^...$and themflag will accept multiline input when it shouldn't. - s (dotAll)Makes
.match newlines. Without this flag, a pattern designed to match "any character" stops at line breaks. - u (Unicode)Enables proper handling of Unicode code points above U+FFFF (emoji, certain scripts). Without it, emoji and some international characters can cause unexpected behavior in character class ranges.
