Skip to content

Conversation

@AngledLuffa
Copy link
Contributor

Additional Semgrex / SSurgeon features and a security patch recommended for deserialization

AngledLuffa and others added 26 commits February 11, 2025 22:57
…nd the NodeAttributes as a single object instead of passing individual pieces. Will make it easier to add more pieces to the NodeAttributes
…- if an Attribute is negated, accept the node not having any value at all
…s which are Maps.

Currently the syntax is @, subject to change

eg,

morphofeatures@foo=bar

In this expression, bar can be a regex, but foo and morphofeatures cannot.
It might be worth adding regex capabilities for both of those,
Also, !@ would be a useful addition.

This checks at Semgrex compile time (not Java compile time) that
the annotation used for key/value is actually a Map

Has a test that the error checking and a simple search both work.
Need to negate the = in the NodePattern output
This map allow repeated elements inside the same brackets
…. Actually, there may not even be a reason to disallow two positive constraints if they are both regex
…t is pointed out that it may be possible for a properly constructed deserializer to execute arbitrary code. See https://github.com/stanfordnlp/CoreNLP/security/advisories/GHSA-wv35-hv9v-526p
Check for HasLemma when converting to make a possible error a bit more readable
@AngledLuffa AngledLuffa merged commit cabc020 into main Mar 24, 2025
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants