Comment by Aissen

> especially due to persistent attempts to use regexes to validate untrusted input

This is not the case here, it's an untrusted regex which can be the issue.