// In IE6, the hash fragment and search params are incorrect if the

??? // fragment contains `?`.

??? getSearch: function() {

????? var match = this.location.href.replace(/#.*/, '').match(/\?.+/);

????? return match ? match[0] : '';

??? },

// Update the hash location, either replacing the current entry, or adding

??? // a new one to the browser history.

??? _updateHash: function(location, fragment, replace) {

????? if (replace) {

??????? var href = location.href.replace(/(javascript:|#).*$/, '');

??????? location.replace(href + '#' + fragment);

????? } else {

??????? // Some browsers require that `hash` contains a leading #.

??????? location.hash = '#' + fragment;

????? }

??? }

英文的個人名字
Regex: ^[a-zA-Z]+(([\'\,\.\-][a-zA-Z ])?[a-zA-Z]*)*$
Payload: aaaaaaaaaaaaaaaaaaaaaaaaaaaa!

Java類名
Regex: ^(([a-z])+.)+[A-Z]([a-z])+$
Payload: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa!

Email格式驗證
Regex: ^([0-9a-zA-Z]([-.\w]*[0-9a-zA-Z])*@(([0-9a-zA-Z])+([-\w]*[0-9a-zA-Z])*\.)+[a-zA-Z]{2,9})$
Payload: a@aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa!

多個郵箱地址驗證
Regex: ^[a-zA-Z]+(([\'\,\.\-][a-zA-Z ])?[a-zA-Z]*)*\s+<(\w[-._\w]*\w@\w[-._\w]*\w\.\w{2,3})>$|^(\w[-._\w]*\w@\w[-._\w]*\w\.\w{2,3})$
Payload: aaaaaaaaaaaaaaaaaaaaaaaa!

復數驗證
Regex: ^\d*[0-9](|.\d*[0-9]|)*$
Payload: 1111111111111111111111111!

模式匹配
Regex: ^([a-z0-9]+([\-a-z0-9]*[a-z0-9]+)?\.){0,}([a-z0-9]+([\-a-z0-9]*[a-z0-9]+)?){1,63}(\.[a-z0-9]{2,7})+$
Payload: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa!

使用python來進行測試有缺陷的正則示例
$ python -c "import re;re.match('^[a-zA-Z]+(([\'\,\.\-][a-zA-Z ])?[a-zA-Z]*)*$', 'aaaaaaaaaaaaaaaaaaaaaaaaaaaa!')"

?

方案1

使用{m, n}替代“*”、“+”等，限制匹配的字符數量，如：

將

var href = location.href.replace(/(javascript:|#).*$/, '');

修改為

var href = location.href.replace(/(javascript:|#).{0, 1000}$/, '');

方案2

使用字符串截取函數slice()或substring(),替代replace()函數，如：

將

var href = location.href.replace(/(javascript:|#).*$/, '');

修改為

var lochref = location.href;

var idxnum = lochref.indexof(“javascript:”);

if(idxnum == -1) idxnum = lochref.indexof(“#”);

var href = idxnum == -1? lochref : lochref.slice(0, idxnum + 1);