Some context
I'm currently building an application which lets user's set up dynamic, queries they can execute later. A great addition to this seems like a regex module, in which users can filter based on a given regular expression.
This would be stored in a database and would be executed against the re.match function in order to limit results for the front-end, however I know certain languages (I'm looking at you, PHP) are vulnerable to code execution attacks if a pattern is passed to regular expression functions, eg:
Example vulnerability (PHP)
// In this example an attacker would be able to inject `replace` with
// the `/e` modifier and set `with` to php code to get code execution.
echo preg_replace($_GET['replace'], $_GET['with'], $string);
The big question
Is this safe to (or what are the dangers of) allowing user input into Python's re module. Could attackers perform backend DOS attacks or even worse, execute arbitrary Python code if they are given the ability to do this?
