The current thinking among the security community is that sites should allow all passwords that aren't found on a wordlist, so that would be one hell of a regex.