정규 표현식(Regex)의 원리와 ReDoS 보안 취약점

// Parse structured web server access logs
const logPattern = /^\[(?<timestamp>[^\]]+)\] "(?<method>[A-Z]+) (?<path>\/[^ ]*) HTTP\/(?<version>[\d.]+)" (?<status>\d{3}) (?<bytes>\d+)$/;

const logLine = '[2026-10-05T02:00:00Z] "POST /api/v1/checkout HTTP/2.0" 200 4821';
const match = logLine.match(logPattern);

if (match?.groups) {
  const { timestamp, method, path, status, bytes } = match.groups;
  console.log({
    time: timestamp,
    route: path,
    httpMethod: method,
    statusCode: Number(status),
    payloadBytes: Number(bytes),
  });
}
// Outputs: { time: '2026-10-05T02:00:00Z', route: '/api/v1/checkout', httpMethod: 'POST', statusCode: 200, payloadBytes: 4821 }

// Require 8-64 chars, at least 1 uppercase, 1 lowercase, 1 digit, 1 special char
const securePasswordRegex = /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[!@#$%^&*()_+\-=\[\]{};':",.<>/?]).{8,64}$/;

function validatePassword(password) {
  // Always limit maximum length first to prevent CPU exhaustion!
  if (typeof password !== 'string' || password.length < 8 || password.length > 64) {
    return false;
  }
  return securePasswordRegex.test(password);
}

console.log(validatePassword("P@ssw0rd2026!")); // true
console.log(validatePassword("weakpassword"));   // false