I am looking at a Java web application that compares all incoming request params and cookies against the following regex. If it matches, it is considered "an attack" and refuses the request. I'm guessing it's trying to prevent SQL injection / class loading or something, but I'm not sure. Can anyone help?

  • 2
    Have you checked out regexr.com/4k0hi ? it should clarify a lot. or do you want to know more?
    – LvB
    Aug 28, 2019 at 14:07
  • 1
    @LvB That link notes the ^ as a beginning character (which it normally is), but I wonder if that is the case given its location in the regular expression. Is it possible it is trying to match a literal ^ but that escaping it isn't necessary because of it is sandwiched between alternators? This would be similar to how ] only needs to be escaped if it shows up inside a character set... Aug 28, 2019 at 14:12
  • @LvB Thanks for sharing that. I did put it in a similar tool, but this one breaks it down much nicer. Aug 28, 2019 at 14:32

1 Answer 1


I'll take a guess... parsing the regular expression, it appears to be matching:

  1. Anything (optional)
  2. . OR ^ OR anything OR [
  3. Quote (single or double)
  4. The literal string class (case insensitive for the c only)
  5. . OR quote (single or double)
  6. ] OR [
  7. Anything (optional)

I'm not 100% sure on this. Sometimes the precedence rules are tricky, and I can't easily test this in java to see exactly how it behaves.

In general though, I find that breaking out the regular expression doesn't shed a lot of light! Certainly, it's not a very helpful rule. It seems to mainly be focused on finding instances of class, but it only does a case insensitive search on the c, so you could easily bypass this rule with clAss.

Given the search for class and quotes, I would guess that this is aiming to find an XSS payload (perhaps someone tried to inject something into the class parameter on a tag). However, it's hard to say for sure. Given that this appears to be a very poorly executed WAF rule anyway (for instance not properly checking in a case-insensitive way, and a few other minor details), I doubt the person who wrote this rule really knew what they were doing, which might make devising their intent much trickier.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .