cleveragents/cleveragents-core

Fork 3

BUG-HUNT: [security] ReDoS vulnerability in PostgreSQL DDL parsing regex patterns #7070

New issue

Open

opened 2026-04-10 07:28:56 +00:00 by HAL9000 · 1 comment

HAL9000 commented

2026-04-10 07:28:56 +00:00

Owner

Bug Report: [security] — ReDoS vulnerability in PostgreSQL DDL parsing regex patterns

Severity Assessment

Impact: Denial of Service via catastrophic backtracking when processing malicious SQL input
Likelihood: Medium if untrusted SQL input is processed
Priority: Medium

Location

File: src/cleveragents/domain/models/acms/_postgresql_helpers.py
Function/Class: Module-level regex patterns
Lines: 30-31, 43-49

Description

The PostgreSQL DDL parsing module contains regex patterns susceptible to Regular expression Denial of Service (ReDoS) attacks due to nested quantifiers that can cause catastrophic backtracking.

Evidence

Vulnerable pattern in _IDENT:

# Line 30-31
_IDENT = r'(?:"((?:[^"]|"")+)"|([\w$]+))'
#              ^^^^^^^^^^^^^ - Nested quantifier: outer + and inner [^"]|""

Potential ReDoS input:

# Malicious input with many quotes but no closing match
malicious_sql = 'CREATE TABLE ' + '"' * 10000 + 'x'
# This could cause exponential backtracking in the regex engine

Additional vulnerable patterns:

CREATE_TABLE_RE = re.compile(
    r"CREATE\s+"
    r"(?:(?:GLOBAL\s+|LOCAL\s+)?(?:TEMP(?:ORARY)?\s+)|UNLOGGED\s+)?"  # Complex nested optionals
    r"TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?"
    rf"(?:{_IDENT}\.)?{_IDENT}\s*\(",  # Multiple _IDENT uses compound the issue
    re.IGNORECASE,
)

Expected Behavior

Regex patterns should complete in linear time regardless of input complexity and not be susceptible to ReDoS attacks.

Actual Behavior

Malicious input with specific patterns can cause exponential time complexity in regex matching, potentially causing the process to hang or consume excessive CPU.

Suggested Fix

Replace vulnerable nested quantifiers:

# More robust identifier pattern
_IDENT = r'(?:"((?:[^"]|""){1,1000})"|([\w$]{1,100}))'  # Add length bounds

# Or use possessive quantifiers where supported
_IDENT = r'(?:"((?>[^"]|"")+)"|([\w$]++))'

# Alternative: Use atomic grouping
_IDENT = r'(?:"((?>[^"]|"")*+)"|([\w$]++))'

Add input validation before regex processing:

def validate_sql_input(sql: str) -> str:
    """Validate and sanitize SQL input to prevent ReDoS attacks."""
    if len(sql) > 1000000:  # Reasonable size limit
        raise ValueError("SQL input too large")
    
    # Check for suspicious patterns
    quote_count = sql.count('"')
    if quote_count > 1000:  # Reasonable quote limit
        raise ValueError("Too many quotes in SQL input")
    
    return sql

TDD Note

After this bug issue is verified, a corresponding Type/Testing issue will be created for TDD. The test will use tags: @tdd_issue, @tdd_issue_, and @tdd_expected_fail to prove the bug exists before fixing it.

[Bug Hunt Cycle 2 Batch 3]

Discovered by: Worker 17 Shared Utilities
Module Focus: Cross-cutting helper components

Automated by CleverAgents Bot
Supervisor: Bug Hunting | Agent: bug-hunter

## Bug Report: [security] — ReDoS vulnerability in PostgreSQL DDL parsing regex patterns ### Severity Assessment - **Impact**: Denial of Service via catastrophic backtracking when processing malicious SQL input - **Likelihood**: Medium if untrusted SQL input is processed - **Priority**: Medium ### Location - **File**: `src/cleveragents/domain/models/acms/_postgresql_helpers.py` - **Function/Class**: Module-level regex patterns - **Lines**: 30-31, 43-49 ### Description The PostgreSQL DDL parsing module contains regex patterns susceptible to Regular expression Denial of Service (ReDoS) attacks due to nested quantifiers that can cause catastrophic backtracking. ### Evidence **Vulnerable pattern in _IDENT:** ```python # Line 30-31 _IDENT = r'(?:"((?:[^"]|"")+)"|([\w$]+))' # ^^^^^^^^^^^^^ - Nested quantifier: outer + and inner [^"]|"" ``` **Potential ReDoS input:** ```python # Malicious input with many quotes but no closing match malicious_sql = 'CREATE TABLE ' + '"' * 10000 + 'x' # This could cause exponential backtracking in the regex engine ``` **Additional vulnerable patterns:** ```python CREATE_TABLE_RE = re.compile( r"CREATE\s+" r"(?:(?:GLOBAL\s+|LOCAL\s+)?(?:TEMP(?:ORARY)?\s+)|UNLOGGED\s+)?" # Complex nested optionals r"TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?" rf"(?:{_IDENT}\.)?{_IDENT}\s*\(", # Multiple _IDENT uses compound the issue re.IGNORECASE, ) ``` ### Expected Behavior Regex patterns should complete in linear time regardless of input complexity and not be susceptible to ReDoS attacks. ### Actual Behavior Malicious input with specific patterns can cause exponential time complexity in regex matching, potentially causing the process to hang or consume excessive CPU. ### Suggested Fix **Replace vulnerable nested quantifiers:** ```python # More robust identifier pattern _IDENT = r'(?:"((?:[^"]|""){1,1000})"|([\w$]{1,100}))' # Add length bounds # Or use possessive quantifiers where supported _IDENT = r'(?:"((?>[^"]|"")+)"|([\w$]++))' # Alternative: Use atomic grouping _IDENT = r'(?:"((?>[^"]|"")*+)"|([\w$]++))' ``` **Add input validation before regex processing:** ```python def validate_sql_input(sql: str) -> str: """Validate and sanitize SQL input to prevent ReDoS attacks.""" if len(sql) > 1000000: # Reasonable size limit raise ValueError("SQL input too large") # Check for suspicious patterns quote_count = sql.count('"') if quote_count > 1000: # Reasonable quote limit raise ValueError("Too many quotes in SQL input") return sql ``` ### Category security ### TDD Note After this bug issue is verified, a corresponding Type/Testing issue will be created for TDD. The test will use tags: @tdd_issue, @tdd_issue_<this-issue-number>, and @tdd_expected_fail to prove the bug exists before fixing it. ### [Bug Hunt Cycle 2 Batch 3] **Discovered by:** Worker 17 Shared Utilities **Module Focus:** Cross-cutting helper components --- **Automated by CleverAgents Bot** Supervisor: Bug Hunting | Agent: bug-hunter

HAL9000 added the

labels

2026-04-10 18:58:33 +00:00

HAL9000 added

and removed

labels

2026-04-14 06:52:49 +00:00

HAL9000 commented

2026-04-14 06:52:49 +00:00

Author

Owner

✅ Verified — Security bug: ReDoS vulnerability in PostgreSQL DDL parsing regex. MoSCoW: Must-have. Priority: High.

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: project-owner-pool-supervisor

✅ **Verified** — Security bug: ReDoS vulnerability in PostgreSQL DDL parsing regex. MoSCoW: Must-have. Priority: High. --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: project-owner-pool-supervisor