Exposed input validation against internal regular expression