Regex match is incomplete or broken.

[roperto]

The characters \/-.?*+^$ are escaped before matching so they don't break an URL.

IMHO that defeats the purpose of having a regex or imposes a rigit limit on what regexes you can write.

My suggestion would be that anything that does not start with http or https is considered a regex WITH delimiters. Better yet, anything that does not start with a letter is a regex and we should not assume / as delimiter.

[brendanheywood]

My 2cents, the idea of the regex was from the very earliest stages of the design of this. I think it should be moved to 100% wwwroot for each env and deprecate the regex concept completly