Purpose of JSLint “disallow insecure in regex” option

Question

I have a line of code that gets the following error when run through JSLint:

Lint at line 604 character 48: Insecure \'^\'.
numExp = parseInt(val[1].replace(         


        

Answer 1

All it's trying to tell you is that it's generally better to specify what can be entered instead of what can't.

In this case, your regex is actually stripping out bad characters, so it's safe to ignore the warning.

Answer 2

"Insecure" means "unspecific" in this context. Both the dot . and the exclusive range [^…] are not clearly defining what should be matched by the regex. For validation purposes, this can propose the risk of successfully matching stuff that you did not think of and do not want (think: white-listing vs. black-listing).

In any case, dot and exclusive range are valid parts of a regular expression, and if they do what you need (like in this case), I would think of the warning as over-cautious.

A malicious user can fiddle with your page logic any time; the warning is more about the regular operation of the page.