Comment by yencabulator

Even then the usual thing about regexp DoS is that "it's possible to write a regexp that is very very slow to process", not about the text being matched.

For validation, the programmer typically controls the regexp exactly as much as they control the rest of the source code.