How to Validate an AI-Generated Regular Expression

AI can quickly turn a natural-language requirement into a regex candidate, but it does not know every input boundary, the target regex engine, or the cases that must fail. A reliable workflow is “describe, generate, add cases, verify,” not “generate and paste into production.”

Start with a testable requirement

“Match GitHub links” is too vague. A better prompt is:

Use a JavaScript regex to match a complete URL. The protocol must be https, the hostname must be exactly github.com, the path must end in .md, and query parameters are not allowed.

Enter the prompt in the “AI Generate” section of the Regex Tester, then select “Generate Regex.” The description is sent to the DevToolbox API and Cloudflare Workers AI, and the generated candidate is placed in the regex input.

AI might return:

^https:\/\/github\.com\/.*\.md$

It looks plausible, but only examples can establish whether it matches the stated requirement.

Prepare both passing and failing cases

Paste these lines into “Test Text”:

https://github.com/openai/openai-node/blob/master/README.md
https://github.com/example/demo.md
http://github.com/example/demo.md
https://evilgithub.com/example/demo.md
https://github.com/example/demo.md?raw=1

The first two lines should match and the last three should fail. The page highlights matched text and lists match positions and capture groups. Testing only successful examples makes overmatching easy to miss.

Flags change the behavior

The tool exposes JavaScript’s g, i, m, s, u, and y flags:

• g finds every match; without it, only the first match is returned.
• i enables case-insensitive matching.
• m lets ^ and $ match the beginning and end of each line.
• s lets a dot match newline characters.
• u enables Unicode-aware parsing.
• y performs a sticky match from the previous lastIndex position.

For a test where each line is a complete URL, enable both g and m. Record the flags with the pattern when moving it into code. Copying only the regex body can change its behavior.

AI does not replace performance and security checks

Nested quantifiers such as (a+)+$ can cause catastrophic backtracking on certain failing inputs. The page executes examples with the browser’s JavaScript regex engine, but it cannot prove that the pattern is safe for every input length.

For routing, authorization, or input validation:

1. Limit the maximum input length.
2. Include empty, oversized, Unicode, and multiline cases.
3. Run unit tests in the target runtime because regex syntax differs between languages.
4. Prefer a mature parser over an increasingly complex regex for security-sensitive formats.

AI reduces drafting time. Positive and negative examples, plus tests in the target environment, determine whether the regex is actually usable.