diff --git a/posthog/queries/base.py b/posthog/queries/base.py index e93b5fad112bc..ac92db83ad00a 100644 --- a/posthog/queries/base.py +++ b/posthog/queries/base.py @@ -435,11 +435,16 @@ def is_truthy_or_falsy_property_value(value: Any) -> bool: def relative_date_parse_for_feature_flag_matching(value: str) -> Optional[datetime.datetime]: - regex = r"(?P[0-9]+)(?P[a-z])" + regex = r"^(?P[0-9]+)(?P[a-z])$" match = re.search(regex, value) parsed_dt = datetime.datetime.now(tz=ZoneInfo("UTC")) if match: number = int(match.group("number")) + + if number >= 10_000: + # Guard against overflow, disallow numbers greater than 10_000 + return None + interval = match.group("interval") if interval == "h": parsed_dt = parsed_dt - relativedelta(hours=number) diff --git a/posthog/queries/test/test_base.py b/posthog/queries/test/test_base.py index 6cfb1472af7cc..a3c4dd9f3a3ab 100644 --- a/posthog/queries/test/test_base.py +++ b/posthog/queries/test/test_base.py @@ -410,6 +410,25 @@ def test_sanitize_keys(key, expected): class TestRelativeDateParsing(unittest.TestCase): + def test_invalid_input(self): + with freeze_time("2020-01-01T12:01:20.1340Z"): + assert relative_date_parse_for_feature_flag_matching("1") is None + assert relative_date_parse_for_feature_flag_matching("1x") is None + assert relative_date_parse_for_feature_flag_matching("1.2y") is None + assert relative_date_parse_for_feature_flag_matching("1z") is None + assert relative_date_parse_for_feature_flag_matching("1s") is None + assert relative_date_parse_for_feature_flag_matching("123344000.134m") is None + assert relative_date_parse_for_feature_flag_matching("bazinga") is None + assert relative_date_parse_for_feature_flag_matching("000bello") is None + assert relative_date_parse_for_feature_flag_matching("000hello") is None + + assert relative_date_parse_for_feature_flag_matching("000h") is not None + assert relative_date_parse_for_feature_flag_matching("1000h") is not None + + def test_overflow(self): + assert relative_date_parse_for_feature_flag_matching("1000000h") is None + assert relative_date_parse_for_feature_flag_matching("100000000000000000y") is None + def test_hour_parsing(self): with freeze_time("2020-01-01T12:01:20.1340Z"): assert relative_date_parse_for_feature_flag_matching("1h") == datetime.datetime(