CQ: DoS - Pass a timeout to limit the execution time

abhinavminhas · abhinavminhas · commit 6f2aa484c53d · 2025-08-20T23:23:03.000+10:00
diff --git a/QueryDB/Resources/Utils.cs b/QueryDB/Resources/Utils.cs
@@ -255,7 +255,7 @@ internal static IEnumerable<MySqlParameter> ToMySqlParameters(object parameters)
         /// </returns>
         internal static IEnumerable<OracleParameter> ToOracleParameters(string sql, object parameters)
         {
-            var matches = Regex.Matches(sql, @"(?<!:):(\w+)");
+            var matches = Regex.Matches(sql, @"(?<!:):(\w+)", RegexOptions.None, TimeSpan.FromSeconds(5));
             var bindNames = matches.Cast<Match>().Select(m => m.Groups[1].Value).ToList();
             IDictionary<string, object> paramDict;
             if (parameters is IDictionary<string, object> dict)

Original file line number	Diff line number	Diff line change
`@@ -255,7 +255,7 @@ internal static IEnumerable<MySqlParameter> ToMySqlParameters(object parameters)`
`255`	`255`	`/// </returns>`
`256`	`256`	`internal static IEnumerable<OracleParameter> ToOracleParameters(string sql, object parameters)`
`257`	`257`	`{`
`258`		`- var matches = Regex.Matches(sql, @"(?<!:):(\w+)");`
	`258`	`+ var matches = Regex.Matches(sql, @"(?<!:):(\w+)", RegexOptions.None, TimeSpan.FromSeconds(5));`
`259`	`259`	`var bindNames = matches.Cast<Match>().Select(m => m.Groups[1].Value).ToList();`
`260`	`260`	`IDictionary<string, object> paramDict;`
`261`	`261`	`if (parameters is IDictionary<string, object> dict)`