Add length-limiting to regex replace filter

jasmith-hs · jasmith-hs · commit 5877dfa3a451 · 2023-12-13T10:32:56.000-05:00
diff --git a/src/main/java/com/hubspot/jinjava/JinjavaConfig.java b/src/main/java/com/hubspot/jinjava/JinjavaConfig.java
@@ -246,7 +246,7 @@ public boolean isValidationMode() {
   }
 
   public long getMaxStringLength() {
-    return maxStringLength;
+    return maxStringLength == 0 ? getMaxOutputSize() : maxStringLength;
   }
 
   public InterpreterFactory getInterpreterFactory() {
diff --git a/src/main/java/com/hubspot/jinjava/interpret/InvalidReason.java b/src/main/java/com/hubspot/jinjava/interpret/InvalidReason.java
@@ -17,7 +17,8 @@ public enum InvalidReason {
     "with value '%s' must be a valid attribute of every item in the list"
   ),
   ENUM("with value '%s' must be one of: %s"),
-  CIDR("with value '%s' must be a valid CIDR address");
+  CIDR("with value '%s' must be a valid CIDR address"),
+  LENGTH("with length '%s' exceeds maximum allowed length of");
 
   private final String errorMessage;
 
diff --git a/src/main/java/com/hubspot/jinjava/lib/filter/RegexReplaceFilter.java b/src/main/java/com/hubspot/jinjava/lib/filter/RegexReplaceFilter.java
@@ -71,6 +71,16 @@ public Object filter(Object var, JinjavaInterpreter interpreter, String... args)
 
     if (var instanceof String) {
       String s = (String) var;
+      long maxStringLength = interpreter.getConfig().getMaxStringLength();
+      if (maxStringLength > 0 && s.length() > maxStringLength) {
+        throw new InvalidInputException(
+          interpreter,
+          this,
+          InvalidReason.LENGTH,
+          s.length(),
+          maxStringLength
+        );
+      }
       String toReplace = args[0];
       String replaceWith = args[1];
 

Original file line number	Diff line number	Diff line change
`@@ -246,7 +246,7 @@ public boolean isValidationMode() {`
`246`	`246`	`}`
`247`	`247`
`248`	`248`	`public long getMaxStringLength() {`
`249`		`- return maxStringLength;`
	`249`	`+ return maxStringLength == 0 ? getMaxOutputSize() : maxStringLength;`
`250`	`250`	`}`
`251`	`251`
`252`	`252`	`public InterpreterFactory getInterpreterFactory() {`