From 070b36902ba7b19d9de48772f09e436c33cb151a Mon Sep 17 00:00:00 2001
From: KaifAhmad1 <kaifahmad087@gmail.com>
Date: Fri, 1 May 2026 15:25:05 +0530
Subject: [PATCH] fix(security): remove polynomial ReDoS regex in
 _detect_format (py/polynomial-redos)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The pattern `<[^>]+>\s+<[^>]+>` in _detect_format() was flagged by CodeQL
(py/polynomial-redos, CWE-1333/730/400) as a polynomial regular expression
on uncontrolled user data.

The `<...>` branch was already unreachable — strings starting with '<' return
'xml' two lines above — but CodeQL does not track that control flow path.

Fix: replace the entire re.match() call with plain startswith / 'in' checks:
- N-Triples with URI subjects are already handled by the XML branch.
- Only blank-node-subject N-Triples (_:word <uri> ...) need detection here,
  which is correctly expressed as startswith('_:') and ' <' in stripped.
- Removed the now-unused `import re`.

Closes security advisory #23.
---
 semantica/explorer/routes/ontology.py | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/semantica/explorer/routes/ontology.py b/semantica/explorer/routes/ontology.py
index 58d20f2c..22b35ca4 100644
--- a/semantica/explorer/routes/ontology.py
+++ b/semantica/explorer/routes/ontology.py
@@ -5,7 +5,6 @@ Ontology Hub routes: registry, URL/file loading, preview, creation, entity searc
 import asyncio
 import ipaddress
 import logging
-import re
 import socket
 import uuid
 from datetime import UTC, datetime
@@ -267,7 +266,11 @@ def _detect_format(content: str) -> str:
         return "xml"
     if "@prefix" in stripped or "@base" in stripped:
         return "turtle"
-    if re.match(r"_:\w+|<[^>]+>\s+<[^>]+>", stripped):
+    # N-Triples blank-node subject: "_:word <predicate-uri> ..."
+    # URI-subject N-Triples ("<uri> <uri>") are already caught by the XML
+    # branch above, so only the blank-node form needs to be checked here.
+    # Plain string ops avoid the polynomial regex that CodeQL flags (py/polynomial-redos).
+    if stripped.startswith("_:") and " <" in stripped:
         return "nt"
     return "turtle"