@GratefulDisciple That's easy to mitigate. First, Google's server code is written in Go, and they use
Russ Cox’s re2 library. They do not have to support backreferences like
\1
, and even if they do, it is still using a Thompson NFA which is not subject to the same sort of exponential race to the heat death of the universe that regex engines based on Henry Spencer's approach are. Plus they could run it under a finite thread timeout.