Regular Expression (Regex)

Important: Starting March 21st, 2025, we are switching to the RE2 regular expression engine. This will enforce stricter validations for regular expressions in the Content Management API (CMA).

Existing behavior

Currently, regular expressions in the CMA allow pattern matching using JavaScript Regular Expressions engine. Users can modify pattern behavior using optional flags, including:

• Global match (`g`) – Returns all matches.

• Case-insensitive (`i`) – Enables case-insensitive matching.

• Multi-line (`m`) – Allows `^` and `$` to match start and end of lines.

• Lookaheads/Lookbehinds (`(?=...)`, `(?<=...)`) – Allows conditional pattern matching.

• Backreferences (`\1`, `\2`, etc.) – Allows repeating captured groups.

For users’ convenience, Contentful validations module provides a number of predefined regex rules covering mainstream scenarios.

Additionally, JavaScript RegExp allows unrestricted use of nested quantifiers and Unicode property escapes (`\p{}`), which can introduce performance and security risks.

• E-mail

An email consist of a user name, followed by ‘@’ followed by a domain name. Characters allowed in a user name are alphanumeric characters (a-z, 0-9), ‘_’, ‘.’, ‘-’. The same holds for domain names.

• URL

A valid URL requires a protocol prefix (ftp, http, https) and a top-level domain.

• Date (US)

Dates in the format ‘MM/DD/YYYY’ where each character represents a digit. Single-digit months and days may or may not have a leading zero. The year may have two or four digits. Please note that only dates after 1900 are allowed.

• Date (European)

Dates in the format ‘DD/MM/YYYY’. The same restrictions as for the US dates apply.

• Phone number (US)

Format ‘X-XXX-XXX-XXXX’ or ‘X-(XXX)-XXX-XXXX’ where each X is a digit. Dots (‘.’) and a single whitespace are also accepted as separators instead of ‘-’. The separators may be omitted.

• US zip code

Accepts zip codes entered as five digits (‘XXXXX’) or five plus four digits ‘XXXXX-XXXX’.

• Time (12 hrs)

Accepts time values in the HH:MM:SS AM/PM format. Allowed hours are from 01 to 12, columns are required, while the use of seconds is optional. The input must contain AM/PM notation in either lower- or upper-case.

• Time (24 hrs)

Accepts time values in the HH:MM:SS format. Allowed hours are from 01 to 24, columns are required, while the use of seconds is optional. The input cannot contain AM/PM notation.

New behaviour (with the RE2 engine)

NOTE: The new behaviour is applied starting March 21st, 2025.

To enhance security, performance, and maintainability, we are transitioning to the RE2 engine, which enforces stricter regular expression evaluation.

The key benefits of this transition include:

• Eliminating catastrophic backtracking: JavaScript's RegExp engine allows complex patterns that can lead to exponential runtime (ReDoS attacks). RE2 prevents these issues by enforcing stricter rules.

• Better performance and efficiency: RE2 executes in linear time complexity, ensuring that regex evaluations do not impact system performance.

• Improved security: By disallowing certain patterns like backreferences and nested quantifiers, RE2 mitigates risks associated with poorly constructed regex.

• Consistency and predictability: Unlike JavaScript's RegExp, RE2 provides a more deterministic matching behavior that prevents unexpected behavior due to excessive backtracking.

With the transition to RE2, some features are no longer, and adjustments will be required.

The following features are no longer supported:

• Global Flag (`g`): RE2 does not support the `g` flag. Instead, users should manually iterate over matches.

• Lookaheads and Lookbehinds: Lookahead (`(?=...)`) and lookbehind (`(?<=...)`) assertions are not available in RE2.

Example fix:

• Backreferences: Backreferences (`\1`, `\2`, etc.) are not supported in RE2.

Example fix:

• Nested quantifiers are restricted: Patterns with nested quantifiers (`(a+)+`) are no longer accepted.

Example fix:

• No unicode property escapes (`\p{}`): RE2 does not support Unicode property escapes (`\p{}`).

Example fix:

Validation Examples Using RE2

• E-mail validation

RE2-compatible regex

^[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}$

• URL validation

RE2-compatible regex

^https?:\/\/[^\s/$.?#].[^\s]*$

• US phone number validation

RE2-compatible regex

^1[-.\s]?(\d{3})[-.\s]?(\d{3})[-.\s]?(\d{4})$

How to test your regex

We recommend using the RE2JS Playground to validate and test your regular expressions for RE2 compatibility.

If you have any questions or need assistance, contact our support team before March 21st, 2025, to ensure a smooth transition.