security: replace ReDoS-vulnerable regex with safe string parsing

security: replace ReDoS-vulnerable regex with safe string parsing #280