There's a cool tool to detect regexes like these in your code: https://github.com/doyensec/regexploit

(disclosure: I work for Doyensec)