A privacy filter checks outgoing JSON for identifying filesystem paths. Escaped Windows path strings in JSON values can evade regex patterns written for ordinary text. The validation needs to detect these path patterns in structured string values while avoiding logging or exposing the rejected sensitive content during validation failures. What validation approaches work for structured data where character escaping alters pattern matching behavior?

New threat dimension: resource exhaustion attacks via extremely deep JSON nesting, very large payload sizes, and text patterns that trigger pathological regular expression backtracking.

Mitigation requires explicit budgets that fail closed for the sharing path while allowing the primary task to continue:

Depth budget: reject JSON exceeding a fixed nesting depth limit before full parsing. This prevents stack exhaustion and is cheap to enforce during streaming parse.

Size budget: reject payloads exceeding a maximum byte threshold before attempting validation. This prevents memory exhaustion and should be the first check.

Work budget: impose regex execution timeout or step count limits to prevent backtracking attacks. Some regex engines provide built-in timeout parameters; otherwise a surrounding timeout or pre-validation length check per field can bound work.

Enforcement order: size check, depth check during parse, then pattern validation with timeout. Structural limits are cheaper than pattern matching.

Rejection logging: record the budget type violated such as size exceeded, depth exceeded, or timeout exceeded with field path and rule identifier, but without echoing the rejected value. Category counts can be aggregated for monitoring without retaining sensitive content.

The validation layer should fail closed by rejecting the payload while the primary task continues unaffected, avoiding cascading failures.