Regular Expression voodoo in ASP

Question

Argh it's a good thing I don't pay my salary on days like this. I copied some regex patterns from my client side Javascript to server side ASP and the email pattern works no probs but an identical function for the password pattern has cost my boss 6 hours today (our little secret).

Function validatePassword(strPass)
  Dim regEx
  Set regEx = new RegExp

  regEx.IgnoreCase = false
  regEx.global = false
  regEx.Pattern = "^(?=.*\d)(?=.*[a-z])(?=.*[A-Z]).{6,10}$"
  ValidatePassword = regEx.Test(strPass)
End Function

It's a simple 1 upper, 1 lower, 1 digit, 6-10 chars pattern and there's zero doubt that it matches as it should but ex. 3DMM9igggg returns false, but gDMM9igggg returns true. It works fine in JS, here: http://www.regular-expressions.info/javascriptexample.html, and in a couple other testers I tried.

WTF? Can somebody lend me their eyes for a sec?

Thanks

I disagree given a bit of context (you don't know the project so really why so unflexing?). It's 62 possible characters to the 10th power for crying out loud. That's nearly a quintillion possibilities. Also it's meant to limit the amount of room you have to play with to try hacks. I take my precautions but if you think up something new or that I haven't taken into account you've only got 10 chars to pull it off. — AEP, Nov 18 '11 at 20:38

score 2 · Answer 1 · answered Nov 17 '11 at 20:01

2

It could be that your particular ASP regex engine does not support lookaheads in the same way as the javascript engine. That is the case with some engines, per the 4th paragraph under advanced topics on this link: http://msdn.microsoft.com/en-us/library/ms972966.aspx#regexnet_topic13

There's also an example of a lookahead-based password test in the 5th paragraph.

If the engine is indeed the problem, a simple-yet-inefficient solution is to run 3 tests: one for an upper, one for a lower, one for a digit with a length test included.

answered Nov 17 '11 at 20:01

Jonathan M

17,145
9
58
91

Thanks Jonathan. Looks like you're right and it figures. I'm stuck on a GoDaddy server for this project and they seem determined to make life for developers as hard as possible. Whatup with their shark beach cartoon 500 error page? (aside:use a web.config file to get around that if it helps anybody) Even the simplest patterns won't match using ?=. Bob Parsons strikes again. Argh. – AEP Nov 17 '11 at 20:29
Yep. Just have to use three tests. – Jonathan M Nov 17 '11 at 20:30
And for some of these rules, why even use a regex? – Joel Coehoorn Nov 17 '11 at 21:58
@JoelCoehoorn, Amen. Regex can be expensive. – Jonathan M Nov 17 '11 at 22:00

Regular Expression voodoo in ASP

1 Answers1