[backend] Fix Regular expression injection

[RomuDeuxfois]

Related issues

• Closes [security] Regular expression injection #1783

[codecov]

Codecov Report

Attention: Patch coverage is 0% with 8 lines in your changes missing coverage. Please review.

Project coverage is 35.10%. Comparing base (24a7d24) to head (27351ec).
Report is 1 commits behind head on master.

Files with missing lines	Patch %	Lines
...main/java/io/openbas/rest/helper/RestBehavior.java	0.00%	5 Missing ⚠️
...n/java/io/openbas/rest/challenge/ChallengeApi.java	0.00%	3 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##             master    #2137      +/-   ##
============================================
- Coverage     35.12%   35.10%   -0.02%     
  Complexity     1418     1418              
============================================
  Files           535      535              
  Lines         16189    16197       +8     
  Branches       1037     1037              
============================================
  Hits           5686     5686              
- Misses        10209    10217       +8     
  Partials        294      294              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[antoinemzs]

Will this cause HTTP 500, where it should be HTTP 400 IMO?

[antoinemzs]

How about throwing https://www.baeldung.com/spring-response-status-exception instead, wrapping the original exception?

[RomuDeuxfois]

You are right
I can throw an ElementNotFoundException and it will be handled by the RestBehavior class

@ExceptionHandler(ElementNotFoundException.class)
public ResponseEntity handleElementNotFoundException(ElementNotFoundException ex) {
ErrorMessage message = new ErrorMessage("Element not found: " + ex.getMessage());
log.warning("ElementNotFoundException: " + ex.getMessage());
return new ResponseEntity<>(message, HttpStatus.NOT_FOUND);
}

[antoinemzs]

That's for HTTP 404, but perhaps there is a readymade handler for 400 as well?

[RomuDeuxfois]

I can use InputValidationException

@ResponseStatus(HttpStatus.BAD_REQUEST)
@ExceptionHandler(InputValidationException.class)
public ValidationErrorBag handleInputValidationExceptions(InputValidationException ex) {
ValidationErrorBag bag = new ValidationErrorBag();
ValidationError errors = new ValidationError();
Map<String, ValidationContent> errorsBag = new HashMap<>();
errorsBag.put(ex.getField(), new ValidationContent(ex.getMessage()));
errors.setChildren(errorsBag);
bag.setErrors(errors);
return bag;
}

[antoinemzs]

sounds like a plan

[RomuDeuxfois]

I made the changes.