Regex Builder

Skill: Regex Builder

Construct and explain regular expressions incrementally with test cases and plain-English documentation.

Trigger

When the user asks to build, create, explain, debug, or optimize a regular expression.

Prerequisites

• [ ] Target pattern or matching criteria described
• [ ] Sample inputs (should match and should NOT match)
• [ ] Target language/flavor (JavaScript, Python, Go, PCRE)

Steps

Step 1: Clarify Requirements

• [ ] What should the regex match? (exact description)
• [ ] What should it NOT match? (edge cases)
• [ ] Capture groups needed? (which parts to extract)
• [ ] Flags needed? (case-insensitive, multiline, global, dotall)
• [ ] Performance constraints? (large input, many matches)

Step 2: Build Incrementally

Start with the simplest pattern that matches, then refine:

1. Literal match — match the exact string first 2. Character classes — generalize with [a-z], \d, \w 3. Quantifiers — add +, *, {n,m} for repetition 4. Anchors — add ^, $ for position 5. Groups — add () for captures, (?:) for non-capturing 6. Alternation — add | for OR logic 7. Lookahead/behind — add (?=), (?<=) for assertions

Step 3: Document the Pattern

Break down every component:

Pattern: ^(?<protocol>https?):\/\/(?<domain>[a-zA-Z0-9.-]+)(?::(?<port>\d{1,5}))?(?<path>\/[^\s?#]*)?(?:\?(?<query>[^\s#]*))?(?:#(?<fragment>\S*))?$

Breakdown:
^                          Start of string
(?<protocol>https?)        Capture "http" or "https"
:\/\/                      Literal "://"
(?<domain>[a-zA-Z0-9.-]+)  Capture domain name
(?::(?<port>\d{1,5}))?     Optional port number (1-5 digits)
(?<path>\/[^\s?#]*)?       Optional path starting with /
(?:\?(?<query>[^\s#]*))?   Optional query string after ?
(?:#(?<fragment>\S*))?     Optional fragment after #
$                          End of string

Step 4: Create Test Cases

✅ Should match:
  "https://example.com"                    → protocol=https, domain=example.com
  "http://api.example.com:8080/v1/users"   → port=8080, path=/v1/users
  "https://example.com/search?q=test#top"  → query=q=test, fragment=top

❌ Should NOT match:
  "ftp://example.com"      → wrong protocol
  "not-a-url"              → no protocol
  ""                       → empty string

Step 5: Validate Edge Cases

• [ ] Empty input
• [ ] Very long input (ReDoS risk)
• [ ] Unicode characters
• [ ] Special regex characters in input (., *, +, ?)
• [ ] Newlines and whitespace

Step 6: Check for ReDoS Vulnerability

Avoid catastrophic backtracking patterns:

• Dangerous: (a+)+, (a|a)+, (a+b?)+ on non-matching input
• Safe: Use atomic groups, possessive quantifiers, or rewrite
• If pattern has nested quantifiers on overlapping character classes → flag as risky

Step 7: Provide Language-Specific Usage

JavaScript:

const pattern = /^https?:\/\/[a-zA-Z0-9.-]+/;
const match = url.match(pattern);
const isValid = pattern.test(url);

Python:

import re
pattern = re.compile(r'^https?://[a-zA-Z0-9.-]+')
match = pattern.match(url)
is_valid = bool(pattern.match(url))

Go:

pattern := regexp.MustCompile(`^https?://[a-zA-Z0-9.-]+`)
match := pattern.FindString(url)
isValid := pattern.MatchString(url)

Common Patterns Reference

Rules

• ALWAYS explain each component in plain English
• ALWAYS provide test cases (match and non-match)
• ALWAYS check for ReDoS vulnerability on complex patterns
• NEVER use regex for HTML parsing — use a proper parser
• Prefer readability over cleverness — comment complex patterns
• Use named capture groups when extracting data
• Mention flavor differences (JS vs Python vs Go) when they matter

Completion

Working regex with plain-English breakdown, test cases, language-specific usage, and ReDoS safety check.

If a Step Fails

• Can't express requirement in regex: Consider a parser or multi-step validation instead
• ReDoS risk detected: Rewrite with non-overlapping character classes or use a timeout
• Flavor mismatch: Note which features are unavailable (e.g., lookbehind in older JS)
• Too complex: Split into multiple simpler patterns applied sequentially