how to rectify "Insecure '.'. error" in Jslint

Question

I've got a regular expression:

return (str+'').replace(/^(.)|\s(.)/g, function ( $1 ) {
    return $1.toUpperCase ( );
});

i got following jslint error:

insecure '.'

What makes the use of the negation of the character set "insecure" ?

Answer 1

You can 'fix' the warning by telling JSLint to ignore it: add regexp: true to your JSLint settings at the top of the file.

Here's JSLint's explanation for why . and [^...] generate warnings by default:

They match more material than might be expected, allowing attackers to confuse applications. These forms should not be used when validating in secure applications.

So if your regexp is used for input/form validation, then you might want to take heed of the warning and use slightly different code. If you're using it for anything else, there's no reason to leave the warning enabled.