fix: probably fix cwe-1333

.github/workflows/check-changes.yml

@@ -23,10 +23,17 @@ jobs:
       id: filter
       with:
         filters: |
-          subscriptions_holder: subscriptions_holder/src
-          t_coubs_initiator: t_coubs_initiator/src
-          coub_smart_searcher: coub_smart_searcher/src
-          kafka_message_producer: kafka_message_producer/src
-          kafka_message_consumer: kafka_message_consumer/src
-          telegram_bot: telegram_bot/src
-          subscriptions_scheduler: subscriptions_scheduler/src
+          subscriptions_holder: 
+            - 'subscriptions_holder/src/**'
+          t_coubs_initiator: 
+            - 't_coubs_initiator/src/**'
+          coub_smart_searcher: 
+            - 'coub_smart_searcher/src/**'
+          kafka_message_producer: 
+            - 'kafka_message_producer/src/**'
+          kafka_message_consumer: 
+            - 'kafka_message_consumer/src/**'
+          telegram_bot: 
+            - 'telegram_bot/src/**'
+          subscriptions_scheduler: 
+            - 'subscriptions_scheduler/src/**'

subscriptions_holder/src/main/java/ru/dankoy/subscriptionsholder/subscriptions_holder/core/service/searchparser/SearchCriteriaParserImpl.java

@@ -13,13 +13,24 @@ public class SearchCriteriaParserImpl implements SearchCriteriaParser {
   @Override
   public List<SearchCriteria> parse(String search) {
     List<SearchCriteria> params = new ArrayList<>();
-    if (search != null) {
-      Pattern pattern = Pattern.compile("(\\w+?)(:|<|>)(\\w+?),");
-      Matcher matcher = pattern.matcher(search + ",");
-      while (matcher.find()) {
-        params.add(new SearchCriteria(matcher.group(1), matcher.group(2), matcher.group(3)));
-      }
+
+    if (search == null || !isValidString(search) || search.length() > 1000) {
+      throw new IllegalArgumentException("Invalid search criteria");
+    }
+
+    search = search + ",";
+
+    Pattern pattern = Pattern.compile("(\\w+?)([:<>])(\\w+?),");
+    Matcher matcher = pattern.matcher(search);
+
+    while (matcher.find()) {
+      params.add(new SearchCriteria(matcher.group(1), matcher.group(2), matcher.group(3)));
     }
+
     return params;
   }
+
+  private boolean isValidString(String str) {
+    return str != null && !str.isEmpty() && str.matches("[a-zA-Z0-9][:<>],");
+  }
 }