🔒 Enhance security: Refactor SQL and JS injection patterns; add ReDoS test cases for input validation.

Author: pcrespov

packages/models-library/src/models_library/string_types.py

@@ -19,12 +19,10 @@
 _LONG_TRUNCATED_STR_MAX_LENGTH: Final[int] = 65536  # same as github descriptions
 
 _SQL_INJECTION_PATTERN: Final[re.Pattern] = re.compile(
-    r"(\b(SELECT|INSERT|UPDATE|DELETE|DROP|UNION|ALTER|CREATE|EXEC|TRUNCATE|MERGE|GRANT|REVOKE|COMMIT|ROLLBACK|DECLARE|CAST|CONVERT)\b|--|;|/\*|\*/|')",
-    re.IGNORECASE,
+    r"(?i)\b(?:SELECT|INSERT|UPDATE|DELETE|DROP|UNION|ALTER|CREATE|EXEC|TRUNCATE|MERGE|GRANT|REVOKE|COMMIT|ROLLBACK|DECLARE|CAST|CONVERT)\b|--|;|/\*|\*/|'",
 )
 _JS_INJECTION_PATTERN: Final[re.Pattern] = re.compile(
-    r"(<\s*script.*?>|</\s*script\s*>|<\s*iframe.*?>|</\s*iframe\s*>|<\s*object.*?>|</\s*object\s*>|<\s*embed.*?>|</\s*embed\s*>|<\s*link[^>]*href\s*=\s*[\"']?\s*javascript:|vbscript:|javascript:|data:text/html|&#x6A;avascript:|&#106;avascript:|<\s*img[^>]*onerror\s*=|<\s*svg[^>]*onload\s*=|on[a-z]+\s*=)",
-    re.IGNORECASE,
+    r"(?i)<(?:script|iframe|object|embed)\b[^>]*>|</(?:script|iframe|object|embed)>|<link\b[^>]*href\s*=\s*[\"']?\s*javascript:|(?:vb|java)script:|data:text/html|&#(?:x6A|106);avascript:|<(?:img|svg)\b[^>]*on\w+\s*=|on[a-z]+\s*=",
 )
 STRING_UNSAFE_CONTENT_ERROR_CODE: Final[str] = "string_unsafe_content"
 

packages/models-library/tests/test_string_types.py

@@ -112,6 +112,19 @@ class InputRequestModel(BaseModel):
         pytest.param(
             "SafeName", "javascript:alert(1)", False, id="invalid-desc-encoded-js"
         ),
+        # ❌ ReDoS (Regular expression Denial of Service) test patterns
+        pytest.param(
+            "SafeName",
+            "<script" + ">" * 1000 + "alert(1)</script>",
+            False,
+            id="redos-nested-tags",
+        ),
+        pytest.param(
+            "SafeName",
+            "SELECT " + "a" * 10000 + " FROM users",
+            False,
+            id="redos-long-sql-keyword",
+        ),
     ],
 )
 def test_safe_string_types(name: str, description: str, should_pass: bool):