Skip to content

Commit ac9cba5

Browse files
committed
RMB-1046: Avoid regex in .replaceAll(" +[*]", "")
https://folio-org.atlassian.net/browse/RMB-1046 Sonar reports: https://sonarcloud.io/project/security_hotspots?id=org.folio%3Araml-module-builder&hotspots=AX9uQp8Uu74XD50_RGf1 > Make sure the regex used here, which is vulnerable to polynomial runtime due to backtracking, cannot lead to denial of service. > > Using slow regular expressions is security-sensitive > > java:S5852 https://sonarcloud.io/organizations/folio-org/rules?open=java%3AS5852&rule_key=java%3AS5852 Code: https://github.com/folio-org/raml-module-builder/blob/v35.4.0/cql2pgjson/src/main/java/org/folio/cql2pgjson/CQL2PgJSON.java#L831 > .replaceAll(" +[*]", "") Task: Use `.replace(" *", " ")` instead. This completely avoids using a regex.
1 parent 53c01dd commit ac9cba5

2 files changed

Lines changed: 3 additions & 1 deletion

File tree

cql2pgjson/src/main/java/org/folio/cql2pgjson/CQL2PgJSON.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -828,7 +828,7 @@ private String queryByFt(String index, DbIndex dbIndex, IndexTextAndJsonValues v
828828
}
829829

830830
// Clean the term. Remove stand-alone ' *', not valid word.
831-
String term = node.getTerm().replaceAll(" +[*]", "").trim();
831+
String term = node.getTerm().replace(" *", " ").trim();
832832
Index schemaIndex = null;
833833
if (targetTable != null) {
834834
schemaIndex = DbSchemaUtils.getIndex(index, targetTable.getFullTextIndex());

cql2pgjson/src/test/java/org/folio/cql2pgjson/CQL2PgJSONTest.java

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -936,6 +936,8 @@ public void idMatch(String testcase) {
936936
"name == \"Lea Long\" # Lea Long",
937937
"name <> \"Lea Long\" # Jo Jane; Ka Keller",
938938
"name = \"Lea *\" # Lea Long", // Loose '*' should be ignored
939+
"name = \"Lea * Long\" # Lea Long",
940+
"name = \"Lea * Long\" # Lea Long",
939941
"name = \"*\" # Jo Jane; Ka Keller; Lea Long", // special case
940942
"name = \"Le* Lo*\" # Lea Long",
941943
"name = \" * * \" # Jo Jane; Ka Keller; Lea Long",

0 commit comments

Comments
 (0)