🛡️ Sentinel: Add strict ASCII control character validation to schemas - #798
🛡️ Sentinel: Add strict ASCII control character validation to schemas#798seonghobae wants to merge 3 commits into
Conversation
Enforced regex pattern `^[^\x00-\x1F\x7F]+$` on string fields intended for identifiers (e.g., `DiagramViewCreateIn.name`, `TableAnnotationUpsertIn.schema_name`, `ApiKeyCreateIn.key_name`) to prevent log injection and terminal escape sequence vulnerabilities.
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
📝 WalkthroughWalkthroughPydantic 입력 스키마의 이름 및 식별자 필드가 ASCII 제어 문자와 DEL 문자를 거부하도록 변경했습니다. 관련 검증 테스트와 보안 지침도 추가했습니다. Changes제어 문자 입력 검증
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
|
@coderabbitai review Please review the current exact head |
|
✅ Action performedReview finished.
|
Enforced regex pattern `^[^\x00-\x1F\x7F]+$` on string fields intended for identifiers (e.g., `DiagramViewCreateIn.name`, `TableAnnotationUpsertIn.schema_name`, `ApiKeyCreateIn.key_name`) to prevent log injection and terminal escape sequence vulnerabilities.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
backend/tests/test_schema_validation.py (1)
47-80: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winASCII 제어 문자 범위의 경계 테스트를 보강해 주세요.
현재 각 테스트는
\x00,\n,\r,\x1b,\x7f만 사용합니다. 정규식 범위의 끝점인\x1f가 빠져 있습니다. 범위 끝점 회귀를 검출하려면 최소한\x1f를 추가하세요. 가능하면\x00부터\x1f까지와\x7f를 모두 파라미터화하세요.최소 수정 예시
-@pytest.mark.parametrize("control_character", ["\x00", "\n", "\r", "\x1b", "\x7f"]) +@pytest.mark.parametrize("control_character", ["\x00", "\n", "\r", "\x1b", "\x1f", "\x7f"])세 파라미터화 테스트에 동일하게 적용하세요.
As per coding guidelines,
**/*.{py,ts,tsx}파일의 동작 변경에는 focused test를 추가하거나 갱신해야 합니다.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@backend/tests/test_schema_validation.py` around lines 47 - 80, Expand the control_character parameterization in test_diagram_view_name_rejects_ascii_control_characters, test_table_annotation_identifiers_reject_ascii_control_characters, and test_api_key_name_rejects_ascii_control_characters to cover the full ASCII control range \x00 through \x1f plus \x7f, preserving the existing validation assertions.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@backend/tests/test_schema_validation.py`:
- Around line 47-80: Expand the control_character parameterization in
test_diagram_view_name_rejects_ascii_control_characters,
test_table_annotation_identifiers_reject_ascii_control_characters, and
test_api_key_name_rejects_ascii_control_characters to cover the full ASCII
control range \x00 through \x1f plus \x7f, preserving the existing validation
assertions.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: abbb714b-bef3-45e7-a0ee-215c9c61ea53
📒 Files selected for processing (3)
.jules/sentinel.mdbackend/app/schemas.pybackend/tests/test_schema_validation.py
|
Closing this branch as superseded by #699. Both PRs target the same protected-base tip ( |
Understood. Acknowledging that this work is superseded by #699 and stopping work on this task. |
1 participant
🚨 Severity: HIGH
💡 Vulnerability: User-provided string fields in Pydantic schemas intended for identifiers or names lacked strict validation against ASCII control characters, only relying on standard length constraints (
min_length,max_length).🎯 Impact: This exposes the system to potential Log Injection (CRLF injection), Null Byte Injection, or terminal escape sequence injection if these malicious string inputs are ingested and subsequently logged, rendered, or passed to execution environments.
🔧 Fix: Enforced explicit regex pattern matching (
pattern=r"^[^\x00-\x1F\x7F]+$") on specific Pydantic string fields (e.g.,DiagramViewCreateIn.name,TableAnnotationUpsertIn.schema_name,TableAnnotationUpsertIn.relation_name, andApiKeyCreateIn.key_name) that do not legitimately require multiline inputs or control characters.✅ Verification: Validated changes using
ruff checkand ensured all 379 backend test cases continue to pass (cd backend && PYTHONPATH=. uv run pytest tests/).PR created automatically by Jules for task 9285260808069055300 started by @seonghobae
Summary by CodeRabbit
보안 개선
테스트
문서