Regex Pattern Catastrophic backtracking

Never use * when + is what you mean. The first thing I noticed about your regex is that almost everything is optional. Only the opening and closing square brackets are required, and I’m pretty sure you don’t want to treat [] as a valid input.

One of the biggest causes of runaway backtracking is to have two or more alternatives that can match the same things. That’s what you’ve got with the |[\p{N}]* part. The regex engine has to try every conceivable path through the string before it gives up, so all those \p{N}* constructs get into an endless tug-of-war over every group of digits.

But there’s no point trying to fix those problems, because the overall structure is wrong. I think this is what you’re looking for:

^\[\p{N}+\](?:,\[\p{N}+\])*$

After it consumes the first token ([1234567]), if the next thing in the string is not a comma or the end of the string, it fails immediately. If it does see a comma, it must go on to match another complete token ([89023432]), or it fails immediately.

That’s probably the most important thing to remember when you’re creating a regex: if it’s going to fail, you want it to fail as quickly as possible. You can use features like atomic groups and possessive quantifiers toward that end, but if you get the structure of the regex right, you rarely need them. Backtracking is not inevitable.

Leave a Comment