[ses4j]

Do you think they're intentionally blacklisting the +, or are they just writing sloppy validation/regexes that aren't up to the spec?

[joezydeco]

Hard to say.

I've encountered it on some very large and famous websites, so I'm thinking it's not always the fault of a bad regex.