-
Notifications
You must be signed in to change notification settings - Fork 133
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Correct regular expression range #2836
Correct regular expression range #2836
Conversation
Signed-off-by: Lantao Jin <ltjin@amazon.com>
d2d83ef
to
4aa5375
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for the fix!
Just wonder previously this this a mistake instead of by design? Is it possible cx has such pattern that become illegal after this PR?
For backward compatibility, we can fix the security issue to add all characters: |
Got it. Feel free to merge. Thanks! |
Signed-off-by: Lantao Jin <ltjin@amazon.com> (cherry picked from commit 7022a09) Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Signed-off-by: Lantao Jin <ltjin@amazon.com>
Signed-off-by: Lantao Jin <ltjin@amazon.com>
Description
Regular expression
[A-z]
also matches the characters:[ \ ] ^ _ `
. It may have overly permissive range risk. Correct it with[a-zA-Z_]
.Issues Resolved
Resolves https://github.com/opensearch-project/sql/security/code-scanning/8
Check List
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.