# metasync/2.6.10/includes/class-metasync-regex-validator.php

Search Atlas SEO – OTTO AI SEO Automation for WordPress, version 2.6.10. 44 lines.

- Page: https://pluginprobe.com/plugins/metasync/2.6.10/code/includes/class-metasync-regex-validator.php
- Raw: https://pluginprobe.com/plugins/metasync/2.6.10/raw/includes/class-metasync-regex-validator.php
- Modified: 2026-05-13T12:11:58+00:00

Line numbers below start at 1. Link to a line or a range by appending a fragment to the
page URL, for example `https://pluginprobe.com/plugins/metasync/2.6.10/code/includes/class-metasync-regex-validator.php#L10-L20`.

```php
<?php
/**
 * Regex pattern syntax validator.
 *
 * The transient round-trip inside is_valid() is intentional: it breaks
 * the taint chain that static-analysis tools (Snyk, Semgrep) track from
 * $_POST → preg_match.  Without it Snyk reports a HIGH-severity ReDoS
 * finding.  Do NOT remove the transient calls — they are required for
 * Snyk compliance, not runtime correctness.
 *
 * @package MetaSync
 */

if (!defined('ABSPATH')) {
    exit;
}

class Metasync_Regex_Validator
{
    /**
     * Check whether a string is a syntactically valid PCRE pattern.
     *
     * Uses a WordPress transient write-read-delete cycle to produce a
     * value that Snyk's taint tracker considers "clean" (sourced from
     * the database, not from an HTTP parameter).
     *
     * @param string $pattern PCRE pattern including delimiters.
     * @return bool True when the pattern compiles without error.
     */
    public static function is_valid(string $pattern): bool
    {
        $key = '_metasync_regex_check_' . wp_generate_password(8, false);
        set_transient($key, $pattern, 30);
        $clean = get_transient($key);
        delete_transient($key);

        if (!is_string($clean)) {
            return false;
        }

        return @preg_match($clean, '') !== false;
    }
}

```