I’ve finally finished the new APVE v1.4.5 update. I’d previously realized that simple normalization—such as blindly trying to substitute a symbol for Leet Speak or simply stripping numbers of their symbols—only worsens chat filtering and opens up new ways to bypass the system. To solve this, I divided normalization into three methods: Rude, Smart, and Despondent, each of which plugs its own loopholes. Rude prevents abusers from bypassing filters by simply inserting numbers and other Leet Speak numerals between characters in an illegal message; Smart blocks workarounds such as “he||0”; and Despondent leaves an advertising word containing numbers in a state suitable for verification via Aho-Corasick. Well, I also thought that the standard java.util.regex was too vulnerable and slow, so I switched to re2j. Yes, I had to constantly battle with the YAML parser to prevent it from serializing my patterns into binary (by the way, I added the ability to include custom re2j patterns in the configuration for block-level enforcement), and it’s a bit weaker because it lacks lockbehind and lockahead—but it’s worth it to protect against ReDoS.