Paul Eggert wrote: > don't give potential > attackers control of regular expressions that might cause excessive > stack growth.
Agreed. This is called "input validation" and is mandatory for secure applications. [1]. [1] https://cwe.mitre.org/data/definitions/20.html
