Confusion about the specifics for regex matching Custom PII types.

[glenn_j]

I'm trying to create some "Custom PII types" to look for passwords, and I have some questions about exactly how you're using the regex to match.

1. Am I required to use double backslashes in the regex entry field?
2. Is there a maximum length for the regex?
3. (most crucially) How are you matching? Are you using "matcher.matches()" or "matcher.find()"? Do I have to account for the entire input as I would with the "matches()" method?

For example, I want to prevent "sqlplus user/password@database", but I want to allow the user to enter "sqlplus user/REDACTED@database", or "sqlplus user/****@database".

A test java class for your edification:

import java.util.regex.*;

public class RegexTest {
 static Pattern p = Pattern.compile("\\b(?:sqlplus(?:\\s+[-/]\\S+)*)\\s+\\w+/(?:(?!\\Z|@|REDACTED\\s*|\\*+\\s*)([^\\s@;]*\\w[^\\s@;]*))");

 private static void testMatchFind(String s) {
 System.out.println("\nTesting string: " + s);
 Matcher m = p.matcher(s);

 System.out.println("matches? " + (m.matches() ? "Yes" : "No"));
 m.reset();
 System.out.println("find? " + (m.find() ? m.group() : "No"));
 }

 public static void main(String... args) {
 // will find "sqlplus user/pass"
 testMatchFind(">> sqlplus user/pass@db");

 // no matches, no find
 testMatchFind(">> sqlplus user/REDACTED@db");

 // no matches, no find
 testMatchFind(">> sqlplus user/***@db");

 // no matches, no find
 testMatchFind(">> sqlplus user/@db");

 // no matches, no find
 testMatchFind(">> sqlplus user/");
 }
}

[Tetiana Khenkina _Enhancera_]

Copying the answer from the support thread for posterity. It's generally faster to get response via our support.

> 1. Am I required to use double backslashes in the regex entry field?

No. If you want word boundary, that will be \b. In Java string literals the second backslash is used to escape the first one, but not in the PII Protector UI.

> 2. Is there a maximum length for the regex?

There is no fixed limit. The way this configuration is stored and processed, it can work with arbitrary length regular expressions. There are practical limits though, since some long regular expressions are expensive to match.

> 3. (most crucially) How are you matching? Are you using "matcher.matches()" or "matcher.find()"? Do I have to account for the entire input as I would with the "matches()" method?

You don't need to account for the entire input. E.g. if you want to detect numbers in the text, you could just do something like \d+
Test input functionality might make it easier to verify different regular expressions and see what gets detected.