Obviously the safest thing would be not to allow it.   Are there notable CPAN packages which contain regexes and the like to validate and defang regular-expression syntax?   Surely there must be ...