ChuckI don't disagree with this, but how about calling eval() on a non-empty and innocuous string? Said string being only one or two regexes away from being not innocuous? How about your web service's json parameter list which when 'touched' by the magic regex has more parameters in it than you thought? People don't sanitize the strings that their own code sends them, and perhaps that is unwise.
GNU social JP is a social network, courtesy of GNU social JP管理人. It runs on GNU social, version 2.0.2-dev, available under the GNU Affero General Public License.
All GNU social JP content and data are available under the Creative Commons Attribution 3.0 license.