The problem with regex is they're impossible to identify in a foolproof way. `^` and `$` are a decent convention, but the behaviour depends on the regex engine being used:

    // Groovy
    java.util.regex.Pattern.compile('^legit-user$').matcher("legit-user\nhacker").find()
    => false

    # Ruby
    !!("legit-user\nhacker" =~ /^legit-user$/)
    => true

Ruby being PCRE means that this behaviour should be consistent across any other PCRE implementations. I'd wager that Shibboleth SP uses this, but they may be doing something different to sanitise strings.

Back on point though, unfortunately the only way to determine if an arbitrary string is a regex is to compile it and see if there are errors. That's much worse than the current implementation here.

As Vlad identified, another option is to flag it on the attribute value, but this would mean a database change. That's undesirable for us at this point but something to keep in mind for future developments. I'd like to see this implemented differently for the next major release.

I'm happy enough with this as it stands.