False positive java:S8786 on simple trailing-digits regex Pattern.compile("\\d+$")

Rules and Languages Report False-positive / False-negative...
1

Product

  • SonarLint for Eclipse 12.4.0.84771
  • Eclipse 2026-06 (4.40)
  • Java 17

Rule

java:S8786 – Regular expressions should not cause non-linear backtracking.

Problem

SonarLint reports java:S8786 on the following regex:

import java.util.regex.Pattern;

class Test {
    private static final Pattern NUMBER_PATTERN =
            Pattern.compile("\\d+$");
}

The issue is reported on the Pattern.compile(...) call.

I believe this is a false positive because the pattern consists only of:

  • a single character class (\d)
  • one greedy quantifier (+)
  • an end-of-string anchor ($)

There are no nested quantifiers, alternations, optionals or lookarounds that could lead to non-linear backtracking.

I also tried the following equivalent patterns, all of which trigger the same warning:

Pattern.compile("(\\d+)$");
Pattern.compile("\\d++$");
Pattern.compile("[0-9]+$");
Pattern.compile("\\p{Digit}+$");

Could you please confirm whether this is a false positive?

Thanks!

3

Hello Jeroen,

Thanks for your feedback! Unfortunately we couldn’t reproduce the issue. It would be nice to get some additional information from you:

  • Logs of your project’s analysis
  • (in case if the project is public one) GitHub / GitLab link

Thanks in advance!

4

Hello Asya,

I realized the warning doesn’t appear for the Pattern by itself. It only shows up when the pattern is actually used. Here’s a complete example that reproduces the warning:

import java.util.regex.Matcher;
import java.util.regex.Pattern;

public final class SonarRegexTest {

    private static final Pattern NUMBER_PATTERN = Pattern.compile("(\\d+)$");

    private SonarRegexTest() {
        throw new IllegalStateException("Utility class");
    }

    public static Integer getLevel(String string) {
        Matcher matcher = NUMBER_PATTERN.matcher(string);
        if(matcher.find()) {
            return Integer.parseInt(matcher.group(1));
        }
        return null;
    }
}

In this example, SonarLint reports:

“Simplify this regular expression to reduce its runtime, as it has super-linear performance due to backtracking.”

5

Hi @Jeroen_van_B

I can reproduce on the case you provides.
In the examples you shared, find is used, which does a partial match. Therefore, the rule engine acts as if it had (?s:.*) attached to its beginning and end unless anchored.
This is why the rule report a quadratic complexity on there three cases even if there is an end anchor.

Pattern.compile("(\d+)$").find();
Pattern.compile("[0-9]+$").find();
Pattern.compile("\p{Digit}+$").find();

Regarding this other case:
cPattern.compile("\d++$").find();

I have the feeling that the rule is raising a FP because it does not take into account possessive quantifiers but I would need to investigate further.

I have created SONARJAVA-6692 to investigate it further.

If you feel like my conclusions are incorrect, please let me know.

Best regards,