title: Is code injection possible in the test string of a RegExp?
body: <p>Is code injeciton possible in the test string of a JavaScript RegExp?</p>
  
  <p>This code is executed server side:</p>
  
  <pre><code>const userInput = "..."; // user input provided by client
  const match = new RegExp(regex, "i").test(userInput);
  </code></pre>
  
  <p>The <code>regex</code> is static and resides server side. Only the <code>userInput</code> string is what we have no control over, the user can enter whatever they want.</p>
  
  <p>Is it possible for an attacker to inject code, or should this be safely handled by the JS <code>RegExp</code> methods?</p>