From 945510e3e05ef9bba849eab986e18b451b282907 Mon Sep 17 00:00:00 2001 From: Levi Broderick Date: Wed, 1 Jul 2026 19:39:34 -0700 Subject: [PATCH] Consolidate and clarify regex warnings --- xml/System.Text.RegularExpressions/Regex.xml | 22 +++++++++---------- .../RegexOptions.xml | 2 +- 2 files changed, 11 insertions(+), 13 deletions(-) diff --git a/xml/System.Text.RegularExpressions/Regex.xml b/xml/System.Text.RegularExpressions/Regex.xml index 75c638e44fc..9293749a464 100644 --- a/xml/System.Text.RegularExpressions/Regex.xml +++ b/xml/System.Text.RegularExpressions/Regex.xml @@ -68,12 +68,16 @@ allow use of regular expressions without instantiating a Regex explicitly. - - The class represents the .NET regular expression engine. - It can be used to quickly parse large amounts of text to find specific character patterns; - to extract, edit, replace, or delete text substrings; and to add the extracted strings to a - collection to generate a report. - + [!WARNING] +> Unrestricted use of this class with untrusted input can subject applications to [denial-of-service attacks](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS). Consult [Best practices for regular expressions in .NET](/dotnet/standard/base-types/best-practices-regex) for guidance on how to safely use this class with untrusted input. + + ]]> The class is immutable (read-only) and thread safe. objects can be created on any thread and shared between threads. For more information, see Thread Safety. @@ -199,9 +203,6 @@ ## Remarks -> [!WARNING] -> When using to process untrusted input, pass a [time-out value](/dotnet/standard/base-types/best-practices-regex#use-time-out-values) to prevent malicious users from causing a [denial-of-service attack](https://www.cisa.gov/news-events/news/understanding-denial-service-attacks). A time-out value specifies how long a pattern-matching method should try to find a match before it times out. - The `pattern` parameter consists of regular expression language elements that symbolically describe the string to match. For more information about regular expressions, see the [.NET Regular Expressions](/dotnet/standard/base-types/regular-expressions) and [Regular Expression Language - Quick Reference](/dotnet/standard/base-types/regular-expression-language-quick-reference) topics. Calling the constructor is equivalent to calling the constructor with a value of for the `options` argument. @@ -347,9 +348,6 @@ ## Remarks -> [!WARNING] -> When using to process untrusted input, pass a [time-out value](/dotnet/standard/base-types/best-practices-regex#use-time-out-values) to prevent malicious users from causing a [denial-of-service attack](https://www.cisa.gov/news-events/news/understanding-denial-service-attacks). A time-out value specifies how long a pattern-matching method should try to find a match before it times out. - The `pattern` parameter consists of regular expression language elements that symbolically describe the string to match. For more information about regular expressions, see the [.NET Regular Expressions](/dotnet/standard/base-types/regular-expressions) and [Regular Expression Language - Quick Reference](/dotnet/standard/base-types/regular-expression-language-quick-reference) topics. A object is immutable, which means that it can be used only for the match parameters you define when you create it. However, it can be used any number of times without being recompiled. diff --git a/xml/System.Text.RegularExpressions/RegexOptions.xml b/xml/System.Text.RegularExpressions/RegexOptions.xml index f60dd736be9..ab99ad376b2 100644 --- a/xml/System.Text.RegularExpressions/RegexOptions.xml +++ b/xml/System.Text.RegularExpressions/RegexOptions.xml @@ -479,7 +479,7 @@ Enable matching using an approach that avoids backtracking and guarantees linear-time processing - in the length of the input. For more information, see the + in the length of the input. For more information, see the "Non-Backtracking mode" section in the Regular Expression Options article.