Regex to validate both CF and Oracle UUIDs

Report · Jul 07, 2016

Hello, all,

TSIA. I once wrote some CF code that would validate a UUID as long as it was in either CF (8-4-4-16) or Oracle (8-4-4-4-12) format.

I have since lost that code, and I'm not quite wrapping my head around a simple regex that will validate both formats.

REMatchNoCase("^[0-9a-z]{8}-([0-9a-z]{4}-){3}[0-9a-z]{12}$",form.str)

.. will match the Oracle format. But I do remember there being a way to validate both formats without using a long regex and the pipe, typing out both formats. Please help me with this.

V/r,

^_^

Report · Jul 07, 2016

REMatchNoCase("^[0-9a-z]{8}-([0-9a-z]{4}-){2}[0-9a-z]{4}-?[0-9a-z]{12}$",form.str)

I think this might do it.. I'll run it in a test file and see..

V/r,

^_^

Report · Jul 07, 2016

Firstly, I did some Google-ing, and noticed something.. odd..

According to Google search, the Oracle format for sys_guid() is just letters and numbers - no hyphens (dashes). So.. I'm not sure where these other UUIDs are coming from, but it's not Oracle or CF. Color me stumped. We've only ever used Oracle and CF, so I can't tell where the 8-4-4-4-12 formats are coming from, but both formats are in the database.

Anyhoo.. here is the code that I tested and it seems to work. Instead of using MATCH(), I'm using REreplaceNoCase() and backreferences to assure that what makes it to the SELECT query is, indeed, a valid UUID with nothing extra (like sql injection or xss).

This is a test of a RegEx for matching both CF and OTHER UUIDs.
<br /><cfset cfuuid = createUUID() & "'A=0&../../../../../folder" />CFUUID: <cfoutput>#cfuuid#</cfoutput>
<cfset oracleuuid = ReplaceNoCase(cfuuid,'-','','all') /><br />OracleUUID: <cfoutput>#oracleuuid#</cfoutput>
<cfset cfuuid = REreplaceNoCase(cfuuid,"([0-9a-z]{8}-?([0-9a-z]{4}-?){2}[0-9a-z]{4}-?[0-9a-z]{12})(.*)","\1","all") />
<cfset oracleuuid = REreplaceNoCase(oracleuuid,"([0-9a-z]{8}-?([0-9a-z]{4}-?){2}[0-9a-z]{4}-?[0-9a-z]{12})(.*)","\1","all") />
<br />After replacement: <cfoutput>#cfuuid# and #oracleuuid#</cfoutput>

Check it out.. test it on a .cfm page on your server, and let me know if / how you can break it.

V/r,

^_^