fix

posthog/queries/base.py

@@ -435,11 +435,16 @@ def is_truthy_or_falsy_property_value(value: Any) -> bool:
 
 
 def relative_date_parse_for_feature_flag_matching(value: str) -> Optional[datetime.datetime]:
-    regex = r"(?P<number>[0-9]+)(?P<interval>[a-z])"
+    regex = r"^(?P<number>[0-9]+)(?P<interval>[a-z])$"
     match = re.search(regex, value)
     parsed_dt = datetime.datetime.now(tz=ZoneInfo("UTC"))
     if match:
         number = int(match.group("number"))
+
+        if number >= 10_000:
+            # Guard against overflow, disallow numbers greater than 10_000
+            return None
+
         interval = match.group("interval")
         if interval == "h":
             parsed_dt = parsed_dt - relativedelta(hours=number)

posthog/queries/test/test_base.py

@@ -410,6 +410,25 @@ def test_sanitize_keys(key, expected):
 
 
 class TestRelativeDateParsing(unittest.TestCase):
+    def test_invalid_input(self):
+        with freeze_time("2020-01-01T12:01:20.1340Z"):
+            assert relative_date_parse_for_feature_flag_matching("1") is None
+            assert relative_date_parse_for_feature_flag_matching("1x") is None
+            assert relative_date_parse_for_feature_flag_matching("1.2y") is None
+            assert relative_date_parse_for_feature_flag_matching("1z") is None
+            assert relative_date_parse_for_feature_flag_matching("1s") is None
+            assert relative_date_parse_for_feature_flag_matching("123344000.134m") is None
+            assert relative_date_parse_for_feature_flag_matching("bazinga") is None
+            assert relative_date_parse_for_feature_flag_matching("000bello") is None
+            assert relative_date_parse_for_feature_flag_matching("000hello") is None
+
+            assert relative_date_parse_for_feature_flag_matching("000h") is not None
+            assert relative_date_parse_for_feature_flag_matching("1000h") is not None
+
+    def test_overflow(self):
+        assert relative_date_parse_for_feature_flag_matching("1000000h") is None
+        assert relative_date_parse_for_feature_flag_matching("100000000000000000y") is None
+
     def test_hour_parsing(self):
         with freeze_time("2020-01-01T12:01:20.1340Z"):
             assert relative_date_parse_for_feature_flag_matching("1h") == datetime.datetime(