What is the regex for path traversal pattern?

The regex pattern for path traversal pattern is `(?:\.\.\/|\.\.\\)`. This pattern validates detects directory traversal attempts (../ or ..\).

How do I use this regex in JavaScript?

In JavaScript, create the regex with `const regex = /(?:\.\.\\/|\.\.\\)/;` and test with `regex.test(yourValue)`. It returns `true` if the value matches.

How do I use this regex in Python?

In Python, use `import re; re.match(r'(?:\.\.\/|\.\.\\)', value)`. The raw string prefix (`r`) prevents Python from interpreting backslashes as escape characters.

Is this regex case-sensitive?

By default, yes. To make it case-insensitive, add the `i` flag in JavaScript (`/(?:\.\.\/|\.\.\\)/i`) or use `re.IGNORECASE` in Python.

Regex for Path Traversal Pattern

Regex Pattern

(?:\.\.\/|\.\.\\)

Detects directory traversal attempts (../ or ..\)

Quick Answer

The regex pattern for path traversal pattern is `(?:\.\.\/|\.\.\\)`. Detects directory traversal attempts (../ or ..\). This works in JavaScript, Python, Ruby, PHP, Java, and most regex engines that support PCRE syntax.

Test Examples

Input	Result
../etc/passwd	✓ Matches
..\windows\system32	✓ Matches
../../secret	✓ Matches
/normal/path	✗ No match
file.txt	✗ No match
./current-dir	✗ No match

Code Examples

javascript

const regex = /(?:\.\.\\/|\.\.\\)/;
const isValid = regex.test(value);

python

import re
pattern = r'(?:\.\.\/|\.\.\\)'
if re.match(pattern, value):
    print("valid")

ruby

pattern = /(?:\.\.\/|\.\.\\)/
if value =~ pattern
  puts "valid"
end

php

if (preg_match('/(?:\.\.\\/|\.\.\\)/', $value)) {
    echo "valid";
}

java

String pattern = "(?:\\.\\.\\/|\\.\\.\\\\)";
boolean isValid = value.matches(pattern);

Frequently Asked Questions

Related Regex Patterns

SQL Injection Pattern

Basic SQL injection detection patterns

XSS Script Tag

Detects HTML script tags (basic XSS detection)

Email Address

Validates a standard email address format

Email (RFC 5322 Compliant)

RFC 5322 compliant email validation with label length limits

URL (HTTP/HTTPS)

Validates HTTP and HTTPS URLs

URL (Any Protocol)

Matches URLs with any protocol (http, https, ftp, ws, etc.)