security fix: regular expression string start/end