Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
The Cost of Regex: ReDoS, Catastrophic Backtracking, Readability and Testing Regex
A pattern with nested quantifiers, overlapping alternation or adjacent .* makes an exponential or polynomial number of attempts on an input that almost matches; in our measurement ^(a+)+$ took 10 seconds at 28 letters in .NET and 0.07 ms with NonBacktracking. We recognize dangerous constructs with PCRE2 step counts and cover Cloudflare's 2019 outage, the Angular validator and server validation, readable patterns with (?x), a test table with xUnit [Theory] and the MailAddress decision for email.
Regex in .NET: GeneratedRegex, RegexOptions, Timeouts, NonBacktracking and Span APIs
Use [GeneratedRegex] for constant patterns, create run-time patterns once and keep them, and give untrusted input a timeout or NonBacktracking; in our measurement new Regex(..., Compiled) on every call was thirty-three thousand times slower than the source generator. A BenchmarkDotNet measurement, allocation-free EnumerateMatches, timeouts and the constructs NonBacktracking rejects, when IgnoreCase reads the culture, and ISBN validation and Turkish slugs for Bookstore, with real output.
Regex on the Command Line and in the IDE: grep -E/-P, ripgrep, sed, git grep, PowerShell and Repo-Wide Find/Replace
The safe order for a repo-wide regex change is: a clean working tree, the file list from git grep, a preview with rg -r, applying with sed -E and checking with git diff. We show the regex differences of grep, ripgrep, PowerShell and the IDEs, a real refactor in Bookstore that turns interpolated log calls into message templates, and why $ does not match in a CRLF file, together with .NET 11's AnyNewLine option.
Regex Flavors: How .NET, JavaScript, PCRE2, POSIX BRE/ERE and RE2 Differ, and Telling Globs from Regex
The same pattern works, fails or silently matches something else depending on the flavor: the Perl family (.NET, JavaScript, PCRE2) offers lookaround through backtracking, RE2 and Rust regex give it up for linear time, and POSIX picks the longest match. We run one probe list in five engines, show Prometheus's full-match =~ with promtool, and the difference between globs and regex with .gitignore and PowerShell.
Lookaround, Inline Flags and Unicode: Lookahead, Lookbehind, (?i), \p{L} and Turkish Characters
Lookahead and lookbehind check what comes after or before a position without consuming characters; variable-length lookbehind works in .NET and JavaScript, is bounded in PCRE2 and absent in ripgrep. We show inline flags, JavaScript's (?i:…) modifiers, \p{L} and the v flag, and, with real output, that whether ıssız matches ISSIZ in .NET depends on the environment because IgnoreCase follows the culture.
Groups and Backreferences: Capturing, Named Groups, Non-capturing Groups, Alternation and $1/${name} in Replacements
Capturing groups are numbered by the order of their opening parentheses, but .NET puts named groups last, so the same $2/$1 replacement gives different results in .NET and JavaScript. We compare named group syntaxes, ES2025 duplicate group names, finding repeated words with backreferences, POSIX's longest-match rule and the replacement syntax of .NET, JavaScript, sed and VS Code with real output, and fix author names in Bookstore's CSV.
Quantifiers and Backtracking: Greedy, Lazy, Possessive and Atomic Groups
A greedy quantifier first takes all it can and gives characters back one by one when the rest of the pattern fails; a lazy one takes little and adds one at a time, yet both spend steps searching for the delimiter, and the correct and fastest option is usually a negated class. We compare greedy, lazy, possessive and atomic groups with PCRE2 step counts and extract endpoint, status and duration from Bookstore's access log with .NET, JavaScript and sed.
How to Read a Regular Expression: Literals, Metacharacters, Character Classes, Anchors and Escaping
The engine tries the pattern from left to right at every start position in the input and returns the leftmost match, which is why escaping metacharacters, writing class ranges correctly and knowing the anchors matter. We show with real output that in .NET \d accepts Arabic-Indic digits and $ accepts a trailing \n, and validate ISBN-13 and order numbers with .NET, JavaScript and grep.
A Git-friendly API Client: Keeping Collections in the Repo with Bruno, OpenCollection YAML and Running Them in CI with the CLI
Keeping a Bruno collection in the repo as OpenCollection YAML files and running it in GitHub Actions with the Bruno CLI turns request changes into readable diffs in code review. A collection with inherited auth for Bookstore, OpenAPI and Postman import (pm.variables.get mistranslated to bru.getVar), secrets via .env, assertions and test scripts, JUnit/HTML reports, the CLI exiting with 2 without a report folder, and a run that silently skips a .bru file in a YAML collection.
Postman in Depth: Collections, Environments, Variable Scopes, Scripts, Tests, Mock Servers and the CLI
Keeping the Postman collection in the repo and running it in CI with Newman or the Postman CLI is the most robust answer to the single-user free plan since March 2026. A hand-written v2.1 collection for Bookstore: OpenAPI import, variable scope precedence, shared versus local values, a pre-request script that gets the token once, pm.test, an iteration failing on a data file, a JUnit report, and why the Postman CLI's local mock returns useless data.
API Testing in the Repo with .http Files: Variables, Environments and Request Chaining in Visual Studio, Rider and VS Code
.http files live in the repo, but the same extension has three dialects: Visual Studio's {{login.response.body.$.accessToken}}, $dotenv and $shared go out unresolved in the JetBrains HTTP Client (ijhttp 2026.2), and 401s are not failures unless you write a test. Two files for Bookstore, http-client.env.json and secret providers, VS Code settings, a JUnit report with client.test, the http-client.private.env.json .gitignore misses, and a token caught by gitleaks.
Testing APIs with curl: Methods, Headers, --json, Authentication, Uploads, Error Codes and Using It in Scripts
The rule for using curl safely in scripts is not to trust its exit code, which is 0 for 401 and 500 too: --fail-with-body exits with 22 and still prints the ProblemDetails. Against Bookstore.Api, with real output: -v and --trace-ascii, -d versus --json (415), keeping the token out of history with --variable and -H @file, cover uploads with -F and the antiforgery error, the limits of --retry, a smoke script, curl.exe quoting on Windows, Invoke-RestMethod and xh.