Conversation
mistahj67
added
the
api
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Organization UI (inherited) Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughAdds a new ChangesFilters feature
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant Client
participant Route
participant FilterMiddleware
participant QueryParameterFilterParser
participant BHContext
participant Handler
Client->>Route: HTTP request with query params
Route->>FilterMiddleware: invoke middleware chain
FilterMiddleware->>QueryParameterFilterParser: ParseAndValidate(request.URL.Query())
QueryParameterFilterParser-->>FilterMiddleware: Filters or ValidationError
alt validation error
FilterMiddleware-->>Client: 400 Bad Request
else success
FilterMiddleware->>BHContext: set Filters
FilterMiddleware->>Handler: call next handler
end
Related Issues: None found in provided information. Related PRs: None found in provided information. Suggested labels: enhancement, api Suggested reviewers: None found in provided information. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@cmd/api/src/api/middleware/filters.go`:
- Around line 38-58: `FilterMiddleware` is rebuilding the query filter parser on
every request instead of once when the middleware is created. Move the
`filters.NewQueryParameterFilterParser(append(model.IgnoreFilters(),
model.AllPaginationQueryParameters()...)...)` construction out of the inner
`http.HandlerFunc` closure in `FilterMiddleware`, so the parser and its regex
compilation happen once per route registration. Keep the request-time logic in
the closure using the prebuilt parser, while preserving the existing
`ParseAndValidate` and `bhctx.Get` behavior.
In `@packages/go/filters/parser.go`:
- Around line 34-39: The QueryParameterFilterParser currently accepts partial
matches from junk input and uses an ambiguous value character class in
NewQueryParameterFilterParser. Update the valuePattern in
QueryParameterFilterParser to anchor the full operator:value expression so
FindStringSubmatch only matches complete filters, and replace the current value
class with an explicit RE2-safe class that matches the documented syntax. Keep
the fix localized to NewQueryParameterFilterParser and the parsing logic that
consumes valuePattern.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro
Run ID: d3a0a5ec-4e3f-4345-86d7-6b1f5dda7441
📒 Files selected for processing (7)
cmd/api/src/api/constant.gocmd/api/src/api/middleware/filters.gocmd/api/src/api/router/router.gocmd/api/src/bhctx/bhctx.gopackages/go/filters/filter.gopackages/go/filters/parser.gopackages/go/filters/parser_test.go
| func NewQueryParameterFilterParser(ignoredParameters ...string) QueryParameterFilterParser { | ||
| return QueryParameterFilterParser{ | ||
| valuePattern: regexp.MustCompile(`([~\w]+):([\w\--_ ]+)`), | ||
| ignoredParameters: ignoredParameters, | ||
| } | ||
| } |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🌐 Web query:
Does Go's regexp package (RE2) treat an escaped hyphen followed by another hyphen inside a character class as forming a byte range, e.g. [\w\--_ ]?
💡 Result:
In Go's regexp package (which is based on the RE2 engine), the behavior of the expression [\w--_ ] inside a character class is as follows: The backslash \ before the first hyphen acts as an escape, treating it as a literal hyphen character within the character class [1][2]. Consequently, it does not function as a range operator. When the RE2 parser encounters the sequence -, it consumes the hyphen as a literal character element [2][3]. The subsequent hyphen in your expression (--) is then interpreted as a range operator because it is placed between the literal hyphen (from -) and the underscore character [4][5]. Therefore, the expression [\w-- ] expands to include: 1. All characters matched by \w (the word characters: [0-9A-Za-z_]) [6][7]. 2. A literal hyphen (the result of the - escape) [2]. 3. The range of characters from hyphen to underscore (hyphen through underscore, inclusive) [5]. 4. The space character [6]. Because the range --_ spans characters in the ASCII table where the hyphen (ASCII 45) comes before the underscore (ASCII 95), this effectively adds all characters between those two points (including punctuation like slash, colon, etc.) to the character class [6][5]. Using an escape before a hyphen is a reliable way to include a literal hyphen in a character class without triggering range behavior [2].
Citations:
- 1: https://pkg.go.dev/regexp/syntax
- 2: https://www.regular-expressions.info/charclass.html
- 3: https://github.com/google/re2/wiki/syntax
- 4: https://www.honeybadger.io/blog/a-definitive-guide-to-regular-expressions-in-go/
- 5: https://github.com/google/re2/blob/7bab3dc83df6a838cc004cc7a7f51d5fe1a427d5/doc/syntax.txt
- 6: https://pkg.go.dev/regexp/syntax@go1.26.4
- 7: https://github.com/golang/go/blob/master/src/regexp/syntax/doc.go
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Inspect the parser and its tests around the regex/matching behavior.
git ls-files packages/go/filters/parser.go packages/go/filters/parser_test.go
echo '--- parser.go ---'
cat -n packages/go/filters/parser.go
echo '--- parser_test.go ---'
cat -n packages/go/filters/parser_test.go
# Programmatic probe for the regex semantics in Go.
python3 - <<'PY'
import re
pattern = r'([~\w]+):([\w\--_ ]+)'
samples = [
"eq:foo",
"eq:foo-bar",
"eq:foo/bar",
"junk eq:foo",
"eq:foo:bar",
]
print("Python-re module is not Go RE2, so this is only a placeholder for structure.")
print("Use the Go regexp docs / repo tests for the actual semantics.")
for s in samples:
m = re.search(pattern, s)
print(s, "=>", m.groups() if m else None)
PYRepository: SpecterOps/BloodHound
Length of output: 12447
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Search for documented/expected filter value syntax beyond parser_test.go.
rg -n "auth\.value|hello world|QueryParameterFilterParser|ParseAndValidate|operator:value|filter" packages/go -g '!**/*vendor*'
# Inspect any additional parser-related tests or docs in the repository.
fd -a -t f 'README.md' . packages/go
fd -a -t f '*filter*' packages/goRepository: SpecterOps/BloodHound
Length of output: 50377
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo '--- packages/go/openapi/src/schemas/api.params.predicate.filter.string.yaml ---'
cat -n packages/go/openapi/src/schemas/api.params.predicate.filter.string.yaml
echo '--- packages/go/openapi/src/paths/config.config.yaml ---'
cat -n packages/go/openapi/src/paths/config.config.yaml
echo '--- parser test excerpt ---'
sed -n '54,90p' packages/go/filters/parser_test.goRepository: SpecterOps/BloodHound
Length of output: 6379
Reject partial filter matches in packages/go/filters/parser.go
FindStringSubmatch can parse a valid operator:value substring inside junk input (junk eq:foo), and [\w\--_ ] relies on an unintended RE2 range. Anchor the regex and use an explicit value class that matches the documented syntax.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/go/filters/parser.go` around lines 34 - 39, The
QueryParameterFilterParser currently accepts partial matches from junk input and
uses an ambiguous value character class in NewQueryParameterFilterParser. Update
the valuePattern in QueryParameterFilterParser to anchor the full operator:value
expression so FindStringSubmatch only matches complete filters, and replace the
current value class with an explicit RE2-safe class that matches the documented
syntax. Keep the fix localized to NewQueryParameterFilterParser and the parsing
logic that consumes valuePattern.
1 participant
Description
Describe your changes in detail
Motivation and Context
Resolves BED-8594
Why is this change required? What problem does it solve?
How Has This Been Tested?
Please describe in detail how you tested your changes.
Include details of your testing environment, and the tests you ran to
see how your change affects other areas of the code, etc.
Screenshots (optional):
Types of changes
Checklist:
Summary by CodeRabbit
400 Bad Requestwith detailed validation information.