Fix security vulnerability: #299
Add spec example to cover #299
Merge branch 'bug/299-regex-security-hole'