2026-07-17-cpp-regex-posix-brackets.md

category	minorAnalysis

• The C++ regular-expression parser (semmle.code.cpp.regex.RegexTreeView) now recognises POSIX bracket sub-expressions inside character classes as single character-matching atoms: POSIX character classes ([[:alpha:]], [[:digit:]], [[:space:]], ...), collating symbols ([[.a.]]), and equivalence classes ([[=a=]]). These are ECMAScript-mode extensions accepted by std::regex but not part of ECMA-262 JavaScript, so they were previously mis-tokenized (the class was incorrectly closed at the inner ]). POSIX character classes whose match set is \d, \s, or \w — or a subset of one (digit, xdigit, space, blank, word, alpha, alnum, upper, lower) — are mapped onto \d/\s/\w for the shared engine's escape-class reasoning. The remaining POSIX classes (punct, cntrl, print, graph) as well as collating and equivalence classes are left opaque: they still parse as single character-consuming class-member atoms, but the shared engine treats their character set as unknown rather than unsoundly equating it with \w.
• Documented that std::regex_constants::multiline is detected by RegexFlowConfigs.qll but not currently modeled in the parse tree — ^ and $ are always treated as string-start/string-end anchors, matching the conservative choice made by other language ReDoS analyses. Precise multiline modeling would require extending the shared RegexTreeViewSig signature and is left as future work.