That means improper configuration for the webserver. Anything that goes through a CSP application goes this way.

Properly configured webserver, should take care of static files without IRIS, just process them itself.

In this case, IRIS will not even know about requests to the static files.

Remember, that you should not use a private Webserver in the production at all, and have to have something manually configured. And any newest IRIS non-community versions since 2023.2 will not even install a private webserver anymore unless the IRIS is updated from some previous version.

you can use $zstrip, where action *P, * is for any place, and P any punctuation

for example

USER>write $zstrip("before!@#$%^&*()_+\-=\[\]{};':""\\|,.<>\/?after", "*P")
beforeafter

And if you just want to check if the string contains any punctuations, you can compare if the original string does not equal the same after $zstrip.

if you wish to use regexp, you can use $match

USER>write $match(".!@", "^[!@#$%^&*()_+\-=\[\]{};':""\\|,.<>\/?]*$")
1