fix: replace scripting pattern blacklist with allowlist (CVE-2025-4318)

[bobbor]

Summary

Replaces the filterScriptingPatterns regex blacklist with a strict allowlist in escapePropertyValue. The blacklist was trivially bypassed via indirect eval (0,eval)(...) — the regex /eval\s*\(/i requires eval directly before ( but indirect eval puts ) between them.

Fix

escapePropertyValue now only permits strings matching valid JS identifiers or dot-notation paths:

/^[a-zA-Z_$][a-zA-Z0-9_$]*(\.[a-zA-Z_$][a-zA-Z0-9_$]*)*$/

This rejects ALL expression forms (parens, brackets, template literals, etc.) rather than trying to enumerate dangerous patterns.

Testing

• All 585 existing tests pass
• Added security-specific tests covering the bypass payload and other injection vectors

References

• SOC Ticket: P456902725
• Original CVE: CVE-2025-4318
• Original fix: PR fix(codegen-ui-react): add sanitization to binding expression #1174 / PR fix: sanitize event bindingEvent and binding field values #1196

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.90%. Comparing base (ce2c72d) to head (0bda826).
⚠️ Report is 4 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1198      +/-   ##
==========================================
+ Coverage   93.87%   93.90%   +0.02%     
==========================================
  Files         150      150              
  Lines        6127     6137      +10     
  Branches     1838     1841       +3     
==========================================
+ Hits         5752     5763      +11     
+ Misses        357      356       -1     
  Partials       18       18              

Files with missing lines	Coverage Δ
...egen-ui-react/lib/react-component-render-helper.ts	92.22% <100.00%> (+0.08%)	⬆️
packages/codegen-ui-react/lib/workflow/events.ts	97.05% <100.00%> (+4.20%)	⬆️

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update ea45c4b...0bda826. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.