CYBERTOOLS / 0x45
LEXICAL SANITIZER // METASYMBOL INJECTION SHIELD

REGEX SHIELD // PATTERN ESCAPER

Sanitize arbitrary user input strings by escaping reserved regular expression characters to prevent syntax crashes and ReDoS injection attacks.

Regex Flavor:
RAW STRING INPUT 0 chars
Metacharacters Detected
No metacharacters detected yet
SAFE ESCAPED REGEX 0 chars
Compiled Engine Code Snippet 

        

      


    


    
    

      

        

          PATTERN PURIFIER // METASYMBOL ARCHITECTURE & REGEX SECURITY
        

        

          Comprehensive defense against catastrophic backtracking, syntax exceptions, and Regular Expression Denial of Service (ReDoS).
        

      


      

        

          

             The Danger of Unescaped User Input
          

          

            When building search filters, highlight tools, or text replacers that incorporate user queries into a dynamic new RegExp(userInput), raw input poses critical vulnerabilities:
          

          
    
            
  • Syntax Exceptions: Entering unbalanced brackets like [ or trailing quantifiers like + or ? triggers immediate SyntaxError: Invalid regular expression terminating script execution.
    • 
            
  • Unintended Wildcards: An unescaped dot . matches any arbitrary character, silently causing searches for api.v1 to accidentally match apixv1.
    • 
            
  • ReDoS Vulnerability: Malicious input containing nested quantifiers like (a+)+$ causes exponential backtracking (O(2ⁿ)), freezing the browser tab or Node.js event loop indefinitely.
    • 
          

        


        

          

             Reserved Metasymbols Across Flavors
          

          

            Standard regular expression engines reserve twelve core metasymbols that must be prefixed with a backslash escape:
          

          
    
            
  • Core Metacharacters: \ ^ $ . * + ? ( ) [ ] { } |.
    • 
            
  • Delimiter Slashes: In languages like JavaScript and PHP where expressions are enclosed in literal slashes /pattern/g, the forward slash / must also be escaped as \/.
    • 
            
  • Python re.escape(): Python 3.7+ escapes only characters that have special meaning in regex, whereas earlier versions escaped all non-alphanumeric characters.
    • 
          

        

      


      

        

          Airgap Zero-Log Privacy Architecture
        

        

          Pattern Purifier executes sanitization purely in client-side memory using vanilla JavaScript string replacement algorithms. No user search strings, confidential regex patterns, or intellectual property are sent to any remote server.