Fix ReDoS vulnerability in regex pattern

[sonupreetam]

Summary

SonarCloud has flagged a security hotspot in complyscribe/tasks/sync_cac_catalog_task.py due to a regex pattern vulnerable to Regular Expression Denial of Service (ReDoS).

SonarCloud Rule: python:S5852 - Using slow regular expressions is security-sensitive

Problem

File: complyscribe/tasks/sync_cac_catalog_task.py
Line: 104
statement = re.search(r"{{.*}}", cac_control.description, re.MULTILINE)The {{.*}} pattern uses a greedy .* quantifier which can cause polynomial runtime due to backtracking when processing crafted malicious input, potentially leading to Denial of Service.

Files to Modify

• sync_cac_catalog_task

Checklist

• Update the regex pattern to prevent catastrophic backtracking
• Ensure existing functionality is preserved (test with sample inputs)
• SonarCloud quality gate passes
• Security hotspot is resolved

Hints

Greedy quantifier with a non-greedy version or use a negated character class

References

• SonarCloud Dashboard
• OWASP ReDoS
• SonarSource Rule S5852

Labels

bug, security, good first issue