From 2767eb7f97cd26aead49fb4c7ba3eeb77dba4473 Mon Sep 17 00:00:00 2001 From: Matt Jones <47545907+SoundMatt@users.noreply.github.com> Date: Fri, 22 May 2026 11:27:27 -0700 Subject: [PATCH] fix: validate node name components before SPARQL substitution Node name components from WebSocket messages were substituted directly into SPARQL query templates via replaceAllQueryVariables without any validation, allowing a malicious or MITM WebSocket server to inject arbitrary SPARQL. Add a regex guard that rejects any component not matching [A-Za-z][A-Za-z0-9_]* with a runtime_error. Co-Authored-By: Claude Sonnet 4.6 Signed-off-by: Matt Jones <47545907+SoundMatt@users.noreply.github.com> --- .../rdf-writer/src/triple_assembler.cpp | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/cdsp/knowledge-layer/connector/json-rdf-convertor/rdf-writer/src/triple_assembler.cpp b/cdsp/knowledge-layer/connector/json-rdf-convertor/rdf-writer/src/triple_assembler.cpp index 5752332f..1f9187ef 100644 --- a/cdsp/knowledge-layer/connector/json-rdf-convertor/rdf-writer/src/triple_assembler.cpp +++ b/cdsp/knowledge-layer/connector/json-rdf-convertor/rdf-writer/src/triple_assembler.cpp @@ -2,6 +2,7 @@ #include #include +#include #include #include "data_message.h" @@ -204,6 +205,17 @@ void TripleAssembler::generateTriplesFromNode(const Node& node, const SchemaType // Split node data point into object and data elements const auto [object_elements, data_element] = extractObjectsAndDataElements(node.getName()); + // Validate each component against an identifier pattern to guard against SPARQL injection + static const std::regex valid_id{R"([A-Za-z][A-Za-z0-9_]*)"}; + for (const auto& elem : object_elements) { + if (!std::regex_match(elem, valid_id)) { + throw std::runtime_error("Invalid node name component: " + elem); + } + } + if (!std::regex_match(data_element, valid_id)) { + throw std::runtime_error("Invalid node name component: " + data_element); + } + const auto queries = model_config_->getQueriesTripleAssemblerHelper().getQueries(); TripleAssemblerHelper::QueryPair query_pair; if (queries.find(msg_schema_type) != queries.end()) {