Commit a258b50
fix(security): remove ReDoS in the Editor SQL guard
CodeQL flagged three java/polynomial-redos alerts (140, 141, 142) on the
text backstop added in 9cb0584. Both were real and reachable by any
authenticated Editor user, measured on JDK 25:
224KB of repeated "SELECT " -> 43.8s of CPU in SELECT_INTO_PATTERN
96KB of repeated "a/*" -> 14.1s of CPU in stripComments
The work happened in classifyStatement, before the query reached the
database, so a single request stalled a request thread for the better part
of a minute. The nginx sqlexec limiter (30r/m + burst 20) bounds the rate
but not the per-request cost.
- SELECT_INTO_PATTERN dropped its leading `\bSELECT\b[\s\S]*?` wildcard and
now anchors on `\bINTO\s+...` alone. The lazy wildcard was what backtracked;
it also bought nothing, since the caller already knows the statement shape.
Because a bare INTO also appears in `INSERT INTO t SELECT ...`,
detectHiddenWrite now consults the pattern only for statements that
actually start with SELECT or WITH — otherwise an INSERT would be
relabelled SELECT INTO.
- stripComments replaced its two regexes with one linear scan. The block
form matched a lazy wildcard between delimiters and degraded on an
unterminated comment.
After: both payloads classify in ~15ms, and 1.4MB of the same input stays
at ~16ms — linear, not quadratic. Verified against the live endpoint: both
hostile payloads return 400 in ~0.12s.
stripQuotedLiterals on the same path was measured and left alone; Java
matches its alternation linearly (27 chars of unterminated literal: <1ms).
Adds two regression tests: an adversarial-input timing bound, and
insertIntoSelect_isNotMisreadAsSelectInto covering the widened pattern.
Full guard behavior re-verified live under real non-admin auth — every CTE
write variant and SELECT INTO still blocked, reads and confirmed admin
writes unaffected.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>1 parent 43dee87 commit a258b50
2 files changed
Lines changed: 77 additions & 9 deletions
File tree
- backend/src
- main/java/com/dbaagent/service
- test/java/com/dbaagent/service
Lines changed: 40 additions & 9 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
62 | 62 | | |
63 | 63 | | |
64 | 64 | | |
| 65 | + | |
| 66 | + | |
| 67 | + | |
| 68 | + | |
| 69 | + | |
65 | 70 | | |
66 | | - | |
| 71 | + | |
67 | 72 | | |
68 | 73 | | |
69 | 74 | | |
| |||
350 | 355 | | |
351 | 356 | | |
352 | 357 | | |
353 | | - | |
354 | | - | |
355 | | - | |
356 | | - | |
| 358 | + | |
| 359 | + | |
357 | 360 | | |
358 | 361 | | |
359 | | - | |
| 362 | + | |
| 363 | + | |
| 364 | + | |
| 365 | + | |
| 366 | + | |
| 367 | + | |
| 368 | + | |
360 | 369 | | |
361 | 370 | | |
| 371 | + | |
| 372 | + | |
| 373 | + | |
| 374 | + | |
362 | 375 | | |
363 | | - | |
364 | | - | |
365 | | - | |
| 376 | + | |
| 377 | + | |
| 378 | + | |
| 379 | + | |
| 380 | + | |
| 381 | + | |
| 382 | + | |
| 383 | + | |
| 384 | + | |
| 385 | + | |
| 386 | + | |
| 387 | + | |
| 388 | + | |
| 389 | + | |
| 390 | + | |
| 391 | + | |
| 392 | + | |
| 393 | + | |
| 394 | + | |
| 395 | + | |
| 396 | + | |
366 | 397 | | |
367 | 398 | | |
368 | 399 | | |
| |||
Lines changed: 37 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
409 | 409 | | |
410 | 410 | | |
411 | 411 | | |
| 412 | + | |
| 413 | + | |
| 414 | + | |
| 415 | + | |
| 416 | + | |
| 417 | + | |
| 418 | + | |
| 419 | + | |
| 420 | + | |
| 421 | + | |
| 422 | + | |
| 423 | + | |
| 424 | + | |
| 425 | + | |
| 426 | + | |
| 427 | + | |
| 428 | + | |
| 429 | + | |
| 430 | + | |
| 431 | + | |
| 432 | + | |
| 433 | + | |
| 434 | + | |
| 435 | + | |
| 436 | + | |
| 437 | + | |
| 438 | + | |
| 439 | + | |
| 440 | + | |
| 441 | + | |
| 442 | + | |
| 443 | + | |
| 444 | + | |
| 445 | + | |
| 446 | + | |
| 447 | + | |
| 448 | + | |
412 | 449 | | |
413 | 450 | | |
414 | 451 | | |
| |||
0 commit comments