Safe wrapper for user regex?

[gra_kev]

I need to be able to solicit a regex from an untrusted user to match against a set of values. Conveniently ignoring the DoS vector, I do want to avoid the obvious bits such as code execution or leaking internal data via variable interpolation.

use Safe;
#my $stranger_danger = '(?{ system("touch /tmp/foobar") })';
my $stranger_danger = '\d';
my @vals = ( 'a', 'b', 'c', '1', '2' );
my $test_env = new Safe;
$test_env->permit( 'regcomp' );
my $tester = $test_env->wrap_code_ref( sub {
    $_ =~ qr/$stranger_danger/
} );

print "Safely matched ", join( ', ', grep { $tester->( $_ ) } @vals ),
+ "\n";

This appears to do what I want (e.g. '(?{ system("touch /tmp/foobar") })' is rejected by Safe), but is there anything else to consider? Is there a better way to go about this?

[ww]

Are you unconcerned with the likes of rm -rf.... and dozens of other system and/or utility commands? I need a clearer sesnse of your goal.

[Anonymous Monk]

Are you unconcerned with the likes of rm -rf....

That is kind of what Safe prevents

[ww]

True. My oversight... so ++ for taking the time to point that out. Thank you. However, my entire answer sort of failed to even hint at what should, perhaps, have been my point, which is (no frills): "It's often better to think about what to allow, and permit only that set, rather than trying to tin-over all the rat holes."

[Anonymous Monk]

Dictionary of regular expressions? XPATH?

[sundialsvc4]

Obviously the safest thing would be not to allow it.   Are there notable CPAN packages which contain regexes and the like to validate and defang regular-expression syntax?   Surely there must be ...