help requested with regular expressions

[vicky chauhan]

Hello All,

I have the following requirement:

The password contains characters from at least three of the following five categories:
• English uppercase characters (A - Z)
• English lowercase characters (a - z)
• Base 10 digits (0 - 9)
• Non-alphanumeric (For example: !, $, #, or %)
• Unicode characters

I am out of my mind but still not able to come up for the regex for above requirement.....

Please help!!

Thanks a ton in advance!!

[Matthew Brown]

It might be possible with a regex, but I wouldn't even try. The logic will be far simpler to follow in normal code.

If I was forced to use them, I'd probably use one for each category, and make sure that at least three matched. Do you have to do it in a single regular expression?

(Dnd what do you mean by "Unicode characters", given that all the other sets are subsets of this?)

[vicky chauhan]

Thanks for the response Matthew..

Yes.. I have to use it in a single regular expression...

I am not able to get the "atleast three out of 5" part!!

[Matthew Brown]

vicky chauhan wrote:Yes.. I have to use it in a single regular expression...

Out of interest, why? If there's any other way possible, it's probably going to be easier.

I am not able to get the "atleast three out of 5" part!!

That was from your post - you said you needed to match at least three of the five conditions. It would be relatively easy to write regular expressions for each one. If you could then write code to see how many of the conditions were true, that would give you what you need. But it depends on the context in which it's being used.

If it has to be one regex, though, best leave it for the real gurus to arrive.

[vicky chauhan]

We will have to wait for the gurus then I think...

Because i am working on a system which has in built code for various components like input field, multi choice list.. etc... So in input field component, there is a provision to set regular expression for validation... but it has to be a single expression... and I do not have access to actual code.. so can not do much towards that...

And when I was speaking "I do not get atleast 3 out of 5 part" --- I mean about myself.. I am not able to solve that part of the issue..

[Matthew Brown]

Ah, sorry.

I actually had to write a very similar bit of code very recently. Fortunately, that was in a framework where I wasn't just limited to the built-in regular expression functionality, but I could define my own validation rule by implementing a particular interface. Hence my questions about whether another way was possible - I was able to sidestep the problem completely.

[James Sabre]

vicky chauhan wrote:
• Unicode characters

It's not obvious to me what you mean by this. ALL characters are UNICODE so it would seem that any characters at all will pass this. A related problem exists with the non-alphanumeric characters since "[^0-9a-zA-Z]" is the set of non-alpha numeric characters but I don't think that is what you really mean!

Can you elaborate on the meanings of these two? Are you expecting the 5 sets to be orthogonal but between them cover every possible character? i.e. 0x0000 - 0xffff .

If you refine the definitions of the set I can do this BUT do you really want to deploy code containing a regex looking something like

"((?=.*?[A-Z])(?=.*?[a-z])(?=.*?[0-9])|(?=.*?[A-Z])(?=.*?[a-z])(?=.*?[-,.+&])|(?=.*?[A-Z])(?=.*?[a-z])(?=.*?[^-0-9A-Za-z,.+!])|(?=.*?[A-Z])(?=.*?[0-9])(?=.*?[-,.+&])|(?=.*?[A-Z])(?=.*?[0-9])(?=.*?[^-0-9A-Za-z,.+!])|(?=.*?[A-Z])(?=.*?[-,.+&])(?=.*?[^-0-9A-Za-z,.+!])|(?=.*?[a-z])(?=.*?[0-9])(?=.*?[-,.+&])|(?=.*?[a-z])(?=.*?[0-9])(?=.*?[^-0-9A-Za-z,.+!])|(?=.*?[a-z])(?=.*?[-,.+&])(?=.*?[^-0-9A-Za-z,.+!])|(?=.*?[0-9])(?=.*?[-,.+&])(?=.*?[^-0-9A-Za-z,.+!])).*"

[vicky chauhan]

Hello James,

Thanks for your response...

And I am sorry for the confusing requirement...

The requirement would be:

Password must contain atleast three of the following:

1) Uppercase Letters (A-Z)
2) Lowercase Letters (a-z)
3) Numerics (0-9)
4) All special characters which are allowed in a password (!, @, #, $, %, &) (I remember I read somewhere that all are not valid.. but don't know that was right or wrong)

Regards,
Vicky

[James Sabre]

vicky chauhan wrote:
4) All special characters which are allowed in a password (!, @, #, $, %, &) (I remember I read somewhere that all are not valid.. but don't know that was right or wrong)

Am I missing something? Since it is your requirement I'm not sure I understand what you mean by "I remember I read somewhere that all are not valid". Since pretty much anything can be included (with suitable escaping), you specify what you or your sponsor want to include in this set.

Based on your current specification I generated

"(?:(?=.*?[A-Z])(?=.*?[a-z])(?=.*?[0-9])|(?=.*?[A-Z])(?=.*?[a-z])(?=.*?[!@#$%&])|(?=.*?[A-Z])(?=.*?[0-9])(?=.*?[!@#$%&])|(?=.*?[a-z])(?=.*?[0-9])(?=.*?[!@#$%&])).*"

Note - I generated this by writing a short Java program to create each combination of 3 from 4 of your sets of characters and then combine these 4 combinations into the regex. Using this approach it is trivial for me to change either the content of the sets or the number sets. Your original requirement required 3 from 5 (ie 10 combinations) and without this automation I would not have considered writing such a regex since it would have been unmaintainable. As it is it will need still need thorough testing.

[vicky chauhan]

Hello James,

Thanks for your comment.

I will test the regular expression. When i said "i read somewhere" -- that was not specific to my requirement.. In general I read somewhere on the web that all special characters might not be valid in password... However, now I know that it depends on specific project.

Regards,
Vicky

[James Sabre]

I'm still a little lost. The urgency of you problem implied that you (or your sponsor) had a specific requirement right now yet your specification of the set of non-alphanumeric characters is very vague. Just specify the sets of characters you want and the rest is easy!

[vicky chauhan]

Thanks James.

I rechecked the specifications and "\W" is allowed.

Password should be atleast 8 character long and should have atleast 3 of the following four: uppercase letters, lowercase letters, numerics and non alphanumeric ("/w")


The expression I came up is:

(?=^.{8,}$)((?=.*\d)(?=.*\W+)(?=.*[A-Z]))|((?=.*\d)(?=.*\W+)(?=.*[a-z]))|((?=.*\W+)(?=.*[A-Z])(?=.*[a-z]))|((?=.*\d)(?=.*[A-Z])(?=.*[a-z]))(?![.\n]).*$”;

But I was looking for something still less complex and small

[James Sabre]

vicky chauhan wrote:Thanks James.

I rechecked the specifications and "\W" is allowed.

Password should be atleast 8 character long and should have atleast 3 of the following four: uppercase letters, lowercase letters, numerics and non alphanumeric ("/w")


The expression I came up is:

(?=^.{8,}$)((?=.*\d)(?=.*\W+)(?=.*[A-Z]))|((?=.*\d)(?=.*\W+)(?=.*[a-z]))|((?=.*\W+)(?=.*[A-Z])(?=.*[a-z]))|((?=.*\d)(?=.*[A-Z])(?=.*[a-z]))(?![.\n]).*$”;

But I was looking for something still less complex and small

Why do you think something "less complex and small" exists? This is not a trivial problem!

My little program generates this regex

 "(?:(?=.*?\\p{Upper})(?=.*?\\p{Lower})(?=.*?\\d)|(?=.*?\\p{Upper})(?=.*?\\p{Lower})(?=.*?\\W)|(?=.*?\\p{Upper})(?=.*?\\d)(?=.*?\\W)|(?=.*?\\p{Lower})(?=.*?\\d)(?=.*?\\W)).{8,}"

I can't get your regex to pass my JUnit tests. How did you test it and on what data? I would expect "!aaaaAxxxxxxxx" to pass but yours fails.

<edit>Converted \ to \\ in the regex so it can be used directly as a String literal in a Pattern</edit>