fix(security): Resolve SonarQube security hotspots

Introduce a default regex match timeout across the library to prevent potential ReDoS attacks (SonarQube rule S6444). Implement `[OnDeserialized]` methods to re-establish object invariants and validate state after deserialization, addressing SonarQube rule S5766.
2026-05-20 17:19:17 -05:00
parent df1805a402
commit e3153e58c4
26 changed files with 268 additions and 58 deletions
@@ -165,7 +165,7 @@ public class UpdateBreakdown : SqlBreakdownBase
            // Check if it's an UPDATE statement
            var sqlTrimmed = sql.TrimStart();
            if (!Regex.IsMatch(sqlTrimmed, @"^\s*UPDATE\b",
-                RegexOptions.IgnoreCase))
+                RegexOptions.IgnoreCase, Strata.SqlTools.SqlBreakdown.Utilities.RegexDefaults.MatchTimeout))
            {
                errorMessage = "SQL statement must start with UPDATE.";
                return false;
@@ -182,7 +182,7 @@ public class UpdateBreakdown : SqlBreakdownBase
            // Pattern: UPDATE table SET column=value [FROM table] [WHERE condition]
            var updateMatch = Regex.Match(sql,
                @"UPDATE\s+([^\s]+)\s+SET\s+(.*?)(?:\s+FROM\s+(.*?))?(?:\s+WHERE\s+(.*))?$",
-                RegexOptions.IgnoreCase | RegexOptions.Singleline);
+                RegexOptions.IgnoreCase | RegexOptions.Singleline, Strata.SqlTools.SqlBreakdown.Utilities.RegexDefaults.MatchTimeout);

            if (!updateMatch.Success)
            {