fix: eliminate ReDoS in DdlStatementParser's NOT VALID detection

CodeQL flagged NOT_VALID's regex (\s+NOT\s+VALID\s*;?\s*$ via find()) as
polynomial: the leading \s+ retries the match at every whitespace position
in the input, so 80KB of padding stalled a request thread for 35s. sql
arrives from POST /migrations/analyze, so it is attacker-controlled.

The NOT VALID clause can only ever be a bounded trailing tail, so replace
the regex with an index-based scan (notValidStart) that walks backward from
the end of the string instead of re-scanning the attacker-controlled prefix.
Verified equivalent to the old regex's behavior on all prior cases (case
insensitivity, multiple internal spaces, trailing semicolons, and the
existing negative cases including the trailing-comment non-match).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: notSumit25

backend/src/main/java/com/dbaagent/service/migration/DdlStatementParser.java

@@ -15,7 +15,6 @@
 @Component
 public class DdlStatementParser {
 
-    private static final Pattern NOT_VALID = Pattern.compile("(?i)\\s+NOT\\s+VALID\\s*;?\\s*$");
     private static final Pattern CONCURRENTLY =
             Pattern.compile("(?i)\\bCREATE\\s+(UNIQUE\\s+)?INDEX\\s+CONCURRENTLY\\b");
     private static final Pattern DEFAULT_FN =
@@ -28,8 +27,9 @@ public class DdlStatementParser {
     public Optional<DdlFacts> parse(String sql) {
         if (sql == null || sql.isBlank()) return Optional.empty();
 
-        boolean notValid = NOT_VALID.matcher(sql).find();
-        String normalized = notValid ? NOT_VALID.matcher(sql).replaceAll("") : sql;
+        int notValidAt = notValidStart(sql);
+        boolean notValid = notValidAt >= 0;
+        String normalized = notValid ? sql.substring(0, notValidAt) : sql;
 
         boolean concurrently = CONCURRENTLY.matcher(normalized).find();
         if (concurrently) {
@@ -145,4 +145,32 @@ private String referencedTable(String sql) {
     private String strip(String s) {
         return s == null ? null : s.replace("\"", "");
     }
+
+    private static int trimEnd(String s) {
+        int e = s.length();
+        while (e > 0) {
+            char c = s.charAt(e - 1);
+            if (c == ';' || Character.isWhitespace(c)) e--;
+            else break;
+        }
+        return e;
+    }
+
+    // A regex tail-match here (\s+NOT\s+VALID...$ via find()) is quadratic on attacker-
+    // controlled input: CodeQL flagged it, and it measured at 35s for 80KB of input.
+    // The clause can only ever be a bounded tail, so scan indices instead of the whole string.
+    private static int notValidStart(String s) {
+        int e = trimEnd(s);
+        int p = e - 5;
+        if (p < 0 || !s.regionMatches(true, p, "VALID", 0, 5)) return -1;
+        int q = p;
+        while (q > 0 && Character.isWhitespace(s.charAt(q - 1))) q--;
+        if (q == p) return -1;
+        int r = q - 3;
+        if (r < 0 || !s.regionMatches(true, r, "NOT", 0, 3)) return -1;
+        int t = r;
+        while (t > 0 && Character.isWhitespace(s.charAt(t - 1))) t--;
+        if (t == r) return -1;
+        return t;
+    }
 }

backend/src/test/java/com/dbaagent/service/migration/DdlStatementParserTest.java

@@ -1,7 +1,9 @@
 package com.dbaagent.service.migration;
 
 import org.junit.jupiter.api.Test;
+import java.time.Duration;
 import static org.assertj.core.api.Assertions.assertThat;
+import static org.junit.jupiter.api.Assertions.assertTimeoutPreemptively;
 
 class DdlStatementParserTest {
 
@@ -163,4 +165,30 @@ void dropColumnStillClassifiesCorrectly_afterDropConstraintFix() {
     void dropNotNull_returnsEmptySoCallerFailsClosed() {
         assertThat(parser.parse("ALTER TABLE orders ALTER COLUMN a DROP NOT NULL")).isEmpty();
     }
+
+    // NOT VALID used to be detected with a regex whose \s+ tail was quadratic on attacker-
+    // controlled input (CodeQL alerts 152/153) — 80KB of padding stalled parse() for 35s.
+    // The index-based scan must stay linear regardless of how much whitespace precedes it.
+    @Test
+    void notValidDetection_staysFastOnAdversarialWhitespace() {
+        String sql = "ALTER TABLE orders ADD CONSTRAINT ck CHECK (id > 0) NOT VALID"
+            + " ".repeat(50_000);
+        assertTimeoutPreemptively(Duration.ofSeconds(2), () -> {
+            var f = parser.parse(sql).orElseThrow();
+            assertThat(f.notValid()).isTrue();
+        });
+    }
+
+    @Test
+    void notValidWithMultipleInternalSpaces_stillDetected() {
+        var f = parser.parse("ALTER TABLE orders ADD CONSTRAINT ck CHECK (id > 0) NOT    VALID").orElseThrow();
+        assertThat(f.notValid()).isTrue();
+    }
+
+    @Test
+    void notValidWithTrailingSemicolon_stillParsesAndDetected() {
+        var f = parser.parse("ALTER TABLE orders ADD CONSTRAINT ck CHECK (id > 0) NOT VALID;").orElseThrow();
+        assertThat(f.operation()).isEqualTo(DdlOperation.ADD_CHECK);
+        assertThat(f.notValid()).isTrue();
+    }
 }