Lukas
60d9c5b340
- Add regex validation utility for query strings - Update filter_config_service to use regex validation - Add comprehensive test coverage for regex validator - Update exception handling for validation errors - Update documentation for tasks Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
124 lines
4.0 KiB
Python
124 lines
4.0 KiB
Python
"""Regex pattern validation with security checks against ReDoS attacks.
|
|
|
|
Provides timeout and complexity limits to prevent catastrophic backtracking
|
|
(ReDoS - Regular Expression Denial of Service).
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import re
|
|
import signal
|
|
from contextlib import contextmanager
|
|
from typing import TYPE_CHECKING
|
|
|
|
import structlog
|
|
|
|
if TYPE_CHECKING:
|
|
from collections.abc import Generator
|
|
|
|
logger = structlog.get_logger()
|
|
|
|
# Constants for regex validation
|
|
MAX_REGEX_LENGTH = 1000
|
|
REGEX_COMPILE_TIMEOUT_SECONDS = 2
|
|
|
|
|
|
class RegexTimeoutError(Exception):
|
|
"""Raised when regex compilation exceeds the timeout limit."""
|
|
|
|
def __init__(self, pattern: str, timeout_seconds: int) -> None:
|
|
"""Initialize with the pattern and timeout value.
|
|
|
|
Args:
|
|
pattern: The regex pattern that timed out.
|
|
timeout_seconds: The timeout value in seconds.
|
|
"""
|
|
self.pattern = pattern
|
|
self.timeout_seconds = timeout_seconds
|
|
super().__init__(
|
|
f"Regex pattern compilation timed out after {timeout_seconds}s "
|
|
f"(possible ReDoS attack): {pattern!r}"
|
|
)
|
|
|
|
|
|
def validate_regex_pattern(pattern: str) -> None:
|
|
"""Validate a regex pattern with length and timeout checks.
|
|
|
|
Validates a regex pattern by:
|
|
1. Checking length does not exceed MAX_REGEX_LENGTH characters
|
|
2. Attempting compilation with a timeout to prevent ReDoS attacks
|
|
|
|
Args:
|
|
pattern: The regex pattern string to validate.
|
|
|
|
Raises:
|
|
ValueError: If the pattern exceeds maximum length.
|
|
RegexTimeoutError: If compilation exceeds the timeout.
|
|
re.error: If the pattern is syntactically invalid.
|
|
|
|
Example:
|
|
>>> validate_regex_pattern(r'^[a-z]+$') # OK
|
|
>>> validate_regex_pattern('a' * 1001) # Raises ValueError
|
|
>>> validate_regex_pattern(r'(a+)+b') # May raise RegexTimeoutError
|
|
"""
|
|
# Check length first (fast, no timeout needed)
|
|
if len(pattern) > MAX_REGEX_LENGTH:
|
|
msg = f"Regex pattern exceeds maximum length of {MAX_REGEX_LENGTH} characters: {len(pattern)} provided"
|
|
logger.warning("regex_validation_length_exceeded", max_length=MAX_REGEX_LENGTH, actual_length=len(pattern))
|
|
raise ValueError(msg)
|
|
|
|
# Attempt compilation with timeout
|
|
try:
|
|
with _timeout_context(REGEX_COMPILE_TIMEOUT_SECONDS):
|
|
re.compile(pattern)
|
|
except TimeoutError as exc:
|
|
logger.warning(
|
|
"regex_compilation_timeout",
|
|
timeout_seconds=REGEX_COMPILE_TIMEOUT_SECONDS,
|
|
pattern_preview=pattern[:100],
|
|
)
|
|
raise RegexTimeoutError(pattern, REGEX_COMPILE_TIMEOUT_SECONDS) from exc
|
|
|
|
|
|
@contextmanager
|
|
def _timeout_context(timeout_seconds: int) -> Generator[None, None, None]:
|
|
"""Context manager to enforce a timeout using signal.alarm().
|
|
|
|
Works on Unix-like systems (Linux, macOS, etc.). On Windows or other
|
|
platforms where signal.SIGALRM is unavailable, compilation proceeds
|
|
without timeout (not ideal, but graceful degradation).
|
|
|
|
Args:
|
|
timeout_seconds: Timeout duration in seconds.
|
|
|
|
Yields:
|
|
None.
|
|
|
|
Raises:
|
|
TimeoutError: If the timeout is exceeded.
|
|
|
|
Note:
|
|
This uses signal.alarm() which is only available on Unix. On Windows,
|
|
timeouts are not enforced (limitation of the platform).
|
|
"""
|
|
# Check if signal.SIGALRM is available (Unix-like systems)
|
|
if not hasattr(signal, "SIGALRM"):
|
|
# Windows or other platforms without SIGALRM
|
|
# Just proceed without timeout (not ideal, but prevents crashes)
|
|
yield
|
|
return
|
|
|
|
def _timeout_handler(signum: int, frame: object) -> None:
|
|
raise TimeoutError("Timeout exceeded")
|
|
|
|
# Set up signal handler
|
|
old_handler = signal.signal(signal.SIGALRM, _timeout_handler)
|
|
signal.alarm(timeout_seconds)
|
|
|
|
try:
|
|
yield
|
|
finally:
|
|
# Always disable the alarm, even if an exception occurred
|
|
signal.alarm(0)
|
|
signal.signal(signal.SIGALRM, old_handler)
|