How to fix "Unsafe". "error" in Jslint

Question

I have a regex:

return (str+'').replace(/^(.)|\s(.)/g, function ( $1 ) { return $1.toUpperCase ( ); }); 

I got the following jslint error:

insecure '.'

What makes using character set negation "unsafe"?

Answer 1

You can “fix” the warning by telling JSLint to ignore it: add regexp: true to your JSLint settings at the top of the file.

Here's an explanation of JSLint why . and [^...] generate warnings by default:

They correspond to more material than might be expected, allowing attackers to confuse applications. These forms should not be used for validation in secure applications.

So, if your regular expression is used to validate input / form, you can pay attention to the warning and use slightly different code. If you use it for anything else, there is no reason to leave the warning on.