fixed a regex vulnerability