dataiku / dataiku/dataiku-headless

fix: bound regex project-library searches

Open
#105 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
11
Forks
0
Avg merge
3d 9h
Merged PRs (30d)
25

Description

Problem

search_project_library accepts arbitrary Python regular expressions and evaluates them against every line of every readable library file. There is no pattern, input-size, file-count, or execution-time bound. max_matches only stops after a match is found.

Impact

A catastrophic-backtracking pattern such as (a+)+$ against a long non-matching line can monopolize a shared executor worker. Repeated requests can exhaust the worker pool and degrade unrelated MCP tools.

Suggested fix

Use a timeout-capable regex engine, or bound searched file/line sizes and reject patterns that exceed a defined complexity policy. Add a total scan-byte/file limit independent of max_matches, and return an explicit truncation result when that limit is reached.

Review evidence

  • dataiku_mcp/tools/project_libraries.py:343
  • User-controlled regex compilation is at lines 364-371.
  • It reads each file and evaluates every line at lines 375-406.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in dataiku_mcp/tools/project_libraries.py at search_project_library and inspect regex compilation around lines 364-371 and file scanning at lines 375-406. Decide the bounded-search behavior from the suggested timeout or complexity approach, including total scan limits independent of max_matches. Done means untrusted patterns and large scans cannot monopolize workers, and reaching a limit returns an explicit truncation result.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.