Merge develop into master (14 Nov)

[HarshP4585]

Describe your changes

• Merge develop into master (14 Nov)

Write your issue number after "Fixes "

Enter the corresponding issue number after "Fixes #"

Please ensure all items are checked off before requesting a review:

• I deployed the code locally.
• I have performed a self-review of my code.
• I have included the issue # in the PR.
• I have labelled the PR correctly.
• The issue I am working on is assigned to me.
• I have avoided using hardcoded values to ensure scalability and maintain consistency across the application.
• I have ensured that font sizes, color choices, and other UI elements are referenced from the theme.
• My pull request is focused and addresses a single, specific feature.
• If there are UI changes, I have attached a screenshot or video to this PR.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch develop

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

General strategy:
To fix the problem, we need to rewrite the regular expression so that there is no ambiguity causing excessive backtracking. In particular, the ambiguous part is [\/\w]*, which can match an empty string and all the same substrings as the previous sequences (e.g., / and \w are almost always part of URL "paths"). The goal is to explicitly and unambiguously describe the allowed path segment. One common approach is to replace ambiguous character classes or repetitions ([\/\w]*) inside a complicated group with a more constrained alternative—such as a negated character class that matches until the next "delimiter" (e.g., ?, #).

Detailed fix:

• Locate line 334 in Clients/src/presentation/pages/AITrustCenter/Subprocessors/index.tsx.

• Replace the problematic regex with an improved version.

• The old regex:

  /^((https?:\/\/)?[\w-]+(\.[\w-]+)+([\/\w]*)*(\?.*)?(#.*)?)$/i

• Improved version (for basic URL validation, safer for performance and retains original intent):

  /^((https?:\/\/)?[\w-]+(\.[\w-]+)+(\/[^\s?#]*)?(\?.*)?(#.*)?)$/i

  • Change: Replace ([\/\w]*)* with (\/[^\s?#]*)?
    • This now matches zero or one path sections of slashes followed by non-"?", "#", or whitespace characters, eliminating catastrophic backtracking.

• The rest of the code remains unchanged.

Required edits and imports:

• Only a single line needs editing.
• No new imports or complex logic required.

---

To fix this issue, make sure that untrusted user input is not directly interpolated into the format string when logging. Instead, supply the format string with static text and use the %s format specifier for the potentially unsafe variable, passing the variable as an extra argument to console.error. Specifically, replace `Error recording history snapshot for parameter ${parameter}:` with 'Error recording history snapshot for parameter %s:' and pass parameter as the second argument to console.error. This is analogous to the recommended fix in the background documentation. There are no required import changes or additional methods needed for implementation — only an adjustment of the logging invocation in recordHistorySnapshot (at line 43 in Servers/utils/history/modelInventoryHistory.utils.ts).

To fix this vulnerability, we need to ensure that only trusted, expected column names can be used for dynamic queries. This is best achieved through whitelisting: define a set of allowed values (valid column names), and for all "generic" cases, only allow these. If the input parameter is not one of the allowed column names, we should reject the request or handle it safely.

Specifically:

• In getCurrentParameterCounts (in Servers/utils/history/modelInventoryHistory.utils.ts), before using ${parameter} in the query string, check if parameter is in the whitelist (e.g.: name, version, owner, etc.—all valid model_inventory table columns that you intend to support).
• If the user input is not one of the allowed columns, throw an error or return a value indicating invalid input.
• The whitelist should be set at the top of the file so it's accessible to all relevant logic and easy to maintain.
• No additional imports are required, just a constant and a check.

This fixes all variants flagged by CodeQL, as all flows reach the vulnerable SQL construction. No other files need to be altered based on the snippets shown.