npmpackage.info

Gathering detailed insights and metrics for safe-regex

Other packages similar to safe-regex

safe-regex-test

1.1.0

Give a regex, get a robust predicate function that tests it against a string.

safe-regex2

5.0.0

detect possibly catastrophic, exponential-time regular expressions

@types/safe-regex

1.1.6

TypeScript definitions for safe-regex

@types/safe-regex-test

1.0.2

TypeScript definitions for safe-regex-test

Gathering detailed insights and metrics for safe-regex

safe-regex - 2.1.1 | npmpackage.info

safe-regex

Detect possibly catastrophic, exponential-time regular expressions

2.1.1

184

NOASSERTION

JavaScript

3.7

Installations

npm install safe-regex

Developer Guide

BETA

Typescript

No

Module System

CommonJS

Node Version

12.10.0

NPM Version

6.10.3 Pull Requests

Open

3

Total

30

Closed

2

Merged

25

Issues

Open

8

Total

22

Closed

14

Releases

Unable to fetch releases

Languages

JavaScript

JavaScript (100%)

Developer

davisjam

Download Statistics

Total Downloads

Last Day

Last Week

Last Month

Last Year

GitHub Statistics

NOASSERTION License

184 Stars

85 Commits

10 Forks

4 Watchers

15 Branches

2 Contributors

Updated on May 30, 2025

Maintainers

View All 2 Contributors

Package Meta Information

Latest Version

2.1.1

Package Id

safe-regex@2.1.1

Size

6.33 kB

NPM Version

6.10.3

Node Version

12.10.0

Published on

Oct 21, 2019

Total Downloads

Cumulative downloads

Total Downloads

NaN

Last Day

NaN

Compared to previous day

Last Week

NaN

Compared to previous week

Last Month

NaN

Compared to previous month

Last Year

NaN

Compared to previous year

Weekly Downloads

Monthly Downloads

Yearly Downloads

Dependencies

regexp-tree

Dev Dependencies

jest

safe-regex

Detect potentially catastrophic exponential-time regular expressions by limiting the star height to 1.

WARNING: This module has both false positives and false negatives. Use vuln-regex-detector for improved accuracy.

Example

Suppose you have a script named safe.js:

1var safe = require('safe-regex');
2var regex = process.argv.slice(2).join(' ');
3console.log(safe(regex));

This is its behavior:

$ node safe.js '(x+x+)+y'
false
$ node safe.js '(beep|boop)*'
true
$ node safe.js '(a+){10}'
false
$ node safe.js '\blocation\s*:[^:\n]+\b(Oakland|San Francisco)\b'
true

Methods

1const safe = require('safe-regex')

const ok = safe(re, opts={})

Return a boolean ok whether or not the regex re is safe and not possibly catastrophic.

re can be a RegExp object or just a string.

If the re is a string and is an invalid regex, returns false.

opts.limit - maximum number of allowed repetitions in the entire regex. Default: 25.

Install

With npm do:

npm install safe-regex

Resources

What should I do if my project has a super-linear regex?

Confirm that it is reachable by untrusted input.
If it is, you can consider whether you can prevent worst-case behavior by trimming the input, revising the regex, or replacing the regex with another algorithm like string functions. For examples, see Table 5 in this article.
If none of those solutions looks feasible, you might also consider changing regex engines. The RE2 bindings might work, though test carefully to confirm there are no semantic portability problems.

Project policies

Versioning

This project follows Semantic Versioning 2.0 (semver).

Here are the project-specific meanings of MAJOR, MINOR, and PATCH updates:

MAJOR: "Incompatible" API changes were introduced. There are two types in this module:
- Changes that modify the interface
- Changes that cause any regexes to be marked as unsafe that were formerly marked as safe
MINOR: Functionality was added in a backwards-compatible manner. There are two types in this module:
- Refactoring the analyses but not changing their results
- Modifying the analyses to reduce false positives, without affecting negatives (false or true)
PATCH: I don't anticipate using PATCH for this module

License

MIT

No vulnerabilities found.

10

Binary-Artifacts

Determines if the project has generated executable (binary) artifacts in the source repository.

10

Dangerous-Workflow

Determines if the project's GitHub Action workflows avoid dangerous patterns.

10

Vulnerabilities

Determines if the project has open, known unfixed vulnerabilities.

9

License

Determines if the project has defined a license.

3

Pinned-Dependencies

Determines if the project has declared and pinned the dependencies of its build process.

1

Code-Review

Determines if the project requires human code review before pull requests (aka merge requests) are merged.

0

Maintained

Determines if the project is "actively maintained".

0

Token-Permissions

Determines if the project's workflows follow the principle of least privilege.

0

CII-Best-Practices

Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.

0

Security-Policy

Determines if the project has published a security policy.

0

Fuzzing

Determines if the project uses fuzzing.

0

Branch-Protection

Determines if the default and release branches are protected with GitHub's branch protection settings.

0

SAST

Determines if the project uses static code analysis.

Score

3.7

/10

Last Scanned on 2025-07-14

The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.

Learn More

Other packages similar to safe-regex

Other packages similar to safe-regex

safe-regex

Installations

Developer Guide

No

CommonJS

12.10.0

6.10.3

Pull Requests

3

30

2

25

Issues

8

22

14

Releases

Unable to fetch releases

Languages

Developer

davisjam

Download Statistics

GitHub Statistics

Maintainers

Package Meta Information

Total Downloads

NaN

Weekly Downloads

Monthly Downloads

Yearly Downloads

Dependencies

Dev Dependencies

safe-regex

Example

Methods

const ok = safe(re, opts={})

Install

Resources

What should I do if my project has a super-linear regex?

Further reading

Project policies

Versioning

License

10

10

10

9

3

1

0

0

0

0

0

0

0

3.7

/10