There are a couple places: ForecastSpecController, TimeSeriesProfileInstanceCatalogController and TimeSeriesProfileParserCatalogController where parameters that accept regular expressions aren't documented as such. Any Controller parameter that accepts a regular expression should link to regexp.html in its description.
Futhermore "" isn't really a valid regular expression. The Oracle regex engine treats it as if it were "." but we shouldn't rely on that. We should use ".*" anywhere it gets fed into a regular expression.
There are some other places in our code where parameters are passed down into pl/sql procedures that do their own wildcard matching - unless specifically called out, those do not do regular expressions and likely do use "*"
If we have Controller parameters that are named incorrectly we should probably deprecate them and make a new parameter with the intended name. We have some helper methods to deal with this.
For example, ForecastSpecController could do something like this to check the new parameter and a deprecated parameter.
String sourceEntityRegex = queryParamAsClass(ctx,
new String[]{Controllers.SOURCE_ENTITY_MASK, Controllers.SOURCE_ENTITY},
String.class, WILDCARD_REGEX );