Fix ReDoS vulnerability (py/redos) in path validation - Security Alert #6

[amazon-q-developer]

Summary

Fixes GitHub CodeQL Security Alert #6 (py/redos, CWE-1333): Inefficient Regular Expression Complexity

Problem

The PATH_PATTERN regex in packages/extended-data/src/extended_data/primitives/types.py contained nested quantifiers that could cause catastrophic backtracking (ReDoS vulnerability):

Vulnerable Pattern:

PATH_PATTERN: re.Pattern[str] = re.compile(r'^(?:[a-zA-Z]:)?[\\/](?:[^<>:"|?*\n]+[\\/])*[^<>:"|?*\n]*$')

The nested quantifiers (?:[^<>:"|?*\n]+[\\/])* and [^<>:"|?*\n]* operating on overlapping character sets could cause exponential time complexity with malicious input like /aaaaaaaaaaaaa!.

Solution

1. Simplified PATH_PATTERN to only match the path prefix (lines 57-60)
2. Added _is_valid_path_string() helper function (after line 202) that validates forbidden characters separately without complex regex
3. Updated string_to_path() to use the safe validation helper
4. Updated reconstruct_special_type() to use the safe path validation

Security Impact

• CWE-1333: Inefficient Regular Expression Complexity
• Severity: High
• Fixed by: Eliminating nested quantifiers and using bounded string validation instead

Testing

Added comprehensive regression tests in test_type_utils.py:

• ReDoS attack pattern completes quickly (< 1 second)
• Forbidden characters are properly rejected
• Legitimate paths continue to work correctly
• Both string_to_path() and reconstruct_special_type() use safe validation

Validation

To run the full test suite:

cd packages/extended-data
pytest tests/core/test_type_utils.py::TestReDoSRegression -v

References

• GitHub Security Alert: https://github.com/jbcom/extended-data/security/code-scanning/6
• CWE-1333: https://cwe.mitre.org/data/definitions/1333.html

Note: No CodeQL alert suppression was used - the vulnerability was fixed at the source.

[amazon-q-developer]

Resolves Issue #68

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[jbdevprimary]

Superseded by the reviewed and released ReDoS hardening in #79 and #81 (now published in extended-data 8.5.4).