#1640·conductor

Security: ReDoS + per-call Pattern compile in PostgresIndexQueryBuilder (CodeQL alert #3)

Author: nthmost-orkesCreated Sep 17, 2026Updated Sep 17, 2026
Labelsbugsecurity

CodeQL alert #3 · rule java/polynomial-redos · severity high (low real risk; borderline) File: `postgres-persistence/src/main/java/com/netflix/conductor/postgres/util/PostgresIndexQueryBuilder.java`

Sub-issue of #1010.

Problem

The condition regex `([a-zA-Z]+)\s?(=|>|<|IN)\s?(.*)` can backtrack to O(n²) on long all-alpha inputs with no operator. Query strings are short in practice, so real risk is low.

Secondary correctness issue: `Pattern.compile(CONDITION_REGEX)` runs inside the method (line 71) on every call instead of being a `static final` field.

Fix direction

Hoist the compiled `Pattern` to a `private static final` field, and tighten the regex so the leading token and trailing value can't backtrack against each other.