dataiku / dataiku/dataiku-headless
fix: bound regex project-library searches
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 11
- Forks
- 0
- Avg merge
- 3d 9h
- Merged PRs (30d)
- 25
Description
Problem
search_project_library accepts arbitrary Python regular expressions and evaluates them against every line of every readable library file. There is no pattern, input-size, file-count, or execution-time bound. max_matches only stops after a match is found.
Impact
A catastrophic-backtracking pattern such as (a+)+$ against a long non-matching line can monopolize a shared executor worker. Repeated requests can exhaust the worker pool and degrade unrelated MCP tools.
Suggested fix
Use a timeout-capable regex engine, or bound searched file/line sizes and reject patterns that exceed a defined complexity policy. Add a total scan-byte/file limit independent of max_matches, and return an explicit truncation result when that limit is reached.
Review evidence
dataiku_mcp/tools/project_libraries.py:343- User-controlled regex compilation is at lines 364-371.
- It reads each file and evaluates every line at lines 375-406.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in dataiku_mcp/tools/project_libraries.py at search_project_library and inspect regex compilation around lines 364-371 and file scanning at lines 375-406. Decide the bounded-search behavior from the suggested timeout or complexity approach, including total scan limits independent of max_matches. Done means untrusted patterns and large scans cannot monopolize workers, and reaching a limit returns an explicit truncation result.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100