One for the regex heroes: I'm trying to match a request containing a password field, but only if the password value: • Is 8 characters or longer • Contains an uppercase character (A-Z) • Contains a lowercase (a-z) • Contains a number (0-9) • Contains a special character (#?!@$%^&*-) This is my current regex matcher:

{
  "matchesJsonPath": "$[?($.newPassword =~ /(?=.+?[A-Z])(?=.+?[a-z])(?=.+?[0-9])(?=.+?[#?!@$%^&*-]).{8,}/i)]"
}

However, this seems to also match

test123!

, i.e., it doesn't discern between upper- and lowercase characters. All other criteria are checked correctly. I don't think there's anything wrong with the regex itself, or at least when I test it with https://regexr.com/, it does not accept

test123!

.. Any ideas?

Maybe easier to break it up with an

and

matchers as the sub-clause to

matchesJsonPath

?

Totally agree it would make things easier to read (as far as that goes with regex), but would it make a difference in matching? But I'll give it a try, thanks! It's just weird to me that multiple online regex testers accept it, but WireMock doesn't..

It shouldn’t make any difference in terms of matching (provided it’s correct of course). Java’s regexes aren’t quite like the other flavours out there unfortunately. I find it’s fairly common for an expression to work in online checkers but not Java unfortunately.

OK, that's good to know. Thanks for the quick response, I'll let you know how I fare. I can get away with it in this specific case, I'll just 'sell' it as a security vulnerability 😉

Not sure I understand, can’t you have something like

.*{8,}

as one of the matchers?

Ah yes, why did I not think of that? I'll try that tomorrow, I was just packing for the day. Thanks!

@Bas Dijkstra I have been able to get some success with chatgpt for cases like this

Hmm.. I changed the mapping file to this:

"bodyPatterns" : [ {
					"matchesJsonPath" : "$[?($.oldPassword == 'abcDEF123@')]"
				},
				{
					"matchesJsonPath" : {
						"expression": "$.newPassword",
						"and" : [
							{
								"matches": "[A-Z]+"
							},
							{
								"matches": "[a-z]+"
							},
							{
								"matches": "[0-9]+"
							},
							{
								"matches": "[#?!@$%^&*-]+"
							},
							{
								"matches": ".*{8,}"
							}
						]
					}
				}

And now it doesn't match anything anymore.. Not even the passwords that were deemed OK before.