正则表达式：处理大字符串时的灾难性回溯

Question

I need help for optimizing my regex for processing URL BBCode Tag. The regex is to check that URL tag has valid pattern and NOT containing whitelist protocol

#(\[url=(?:"|"|\'|)(((((?!https|http|ftp|mailto).)*):(//)?)([^\[\]]*))(?:"|"|\'|)\])(.*)(\[/url\])#siU

Regex will ignore :

• [url="www.example.com"]example[/url]
• [url="https://example.com"]example[/url]
• [url="http://example.com"]example[/url]
• [url="ftp://example.com"]example[/url]
• [url="mailto:[e-mail]"]example[/url]

And match when :

• [url="ymsgr://example.com"]example[/url]
• [url="anyprotocol://example.com"]example[/url]

It's run well and has no issue, until user create string data with more than 10000 char length, that will make Catastrophic backtracking

Regex101 Reference Link

Answer 1

Here is a slightly optimized version:

(?:\[url=(?:"|"|\'|)(?:(?:(?:(?:(?!https?|ftp|mailto).)*):(?://)?)(?:(?!"|"|&quote;).)++)(?:"|"|\'|)\])(?:(?!\[/url\]).)++(?:\[/url\])

The main optimizations here are:

• changed most of the capture groups into non-capture groups (?:)
• changed .* expressions no tempered greedy tokens/excludes (?:(?!).)
• added some possessive quantifiers ++
• (switching from protocol blacklist to a whitelist would also help a lot)

Demo

^{If you are going to use this pattern often it might be worth to mention the S|Study PHP regex flag. Guessing from the description, it should not be useful but might be still worth the trial. I have not tested it.}

Sample Code

---

Regarding your updated sample: It's probably best to do this in a two step process: first, extract the URL meta tags with a much simpler regex, e.g.

\[url=.*\[/url\]

then, use your original regex or the one above to verify the input format.