[PATCH] regex: Add \A and \z synonyms to \` and \'

David A. Wheeler dwheeler@dwheeler.com
Mon May 5 17:07:18 GMT 2025


Just to be clear, the goal for many is to have a *single* pair of sequences
that *always* means "beginning of string" and "end of string" regex anchors on all platforms
and *not* just POSIX regular expressions. The pair should work on .NET, Java, etc.

A common use for regexes in security is to check inputs, which needs such anchors all over.
Today the spelling of these anchors varies between implementations, leading to errors.
LLMs are likely to make the problem worse, as they'll often reuse a regex
without correctly noting its context. To be fair, humans are prone to this too.
I believe the only *practical* available option is \A ... \z.

The following platforms (including languages) already support \A...\z (*not* \A ... \Z):
Java, .NET/C#, Perl, PCRE, PHP (using PCRE), Ruby,
RE2 which is widely used by Go, and Rust crate regex which is widely used by Rust.

The phrase "\Z" cannot become a generally-agreed symbol for end-of-string,
because it's already used for "optional newline followed by end of string" on many
platforms, including Java, .NET/C#, Perl, PCRE , PHP (using PCRE), and Ruby.
Citations:
https://learn.microsoft.com/en-us/dotnet/standard/base-types/anchors-in-regular-expressions#end-of-string-or-before-ending-newline-z
https://www.pcre.org/original/doc/html/pcrepattern.html#SEC5
https://ruby-doc.org/core-2.5.8/Regexp.html

Absolutely NONE of these platforms support \` ... \' for beginning...end of string.

The Python developers have *specifically* rejected \` ... \' for this purpose. The arguments listed:

> 1. Since \' usually happens at the end of the regular expression,
>  see what it looks like: r'\`"[^"]+"\''. It is difficult to see where the end of the string.
>  Even if you use double quotes, adjacent ' and " are hard to red: r"\`'[^']+'\'".
> 2. On GitHub and other programmer communication sites which use backquotes
> to mark a code, it is difficult to use for code containing a backquote.
> 3. There is a historical ban of using backquotes in Python syntax.
I'll add that I don't think this pair is very memorable.

The Python developers have instead decided to add support for \z for "end-of-string"
(they already had \A for "beginning of string"), switch Python's internal code to use \z instead of \Z,
and are considering deprecation (with possible long-term removal) of \Z for end-of-string.
So they'll be another platform supporting \A ... \z. Details: https://github.com/python/cpython/issues/133306

Anyway, I hope that \A ... \z would be supported here as well.
It'd be nice to be able to say "this works practically everywhere" instead of the
complicated explanations that must be done today.

Thanks!

--- David A. Wheeler


More information about the Libc-alpha mailing list