Skip to content

escape regex metachars in StringDetector word matching#1880

Open
bereketDeneke wants to merge 1 commit into
NVIDIA:mainfrom
bereketDeneke:fix/stringdetector-escape-word-regex
Open

escape regex metachars in StringDetector word matching#1880
bereketDeneke wants to merge 1 commit into
NVIDIA:mainfrom
bereketDeneke:fix/stringdetector-escape-word-regex

Conversation

@bereketDeneke

@bereketDeneke bereketDeneke commented Jun 24, 2026

Copy link
Copy Markdown

What this change does

StringDetector's "word" match mode interpolated each search string directly into a regex (r"\b" + s + r"\b"). When a target string contained regex metacharacters, it was interpreted as a pattern rather than a literal — a real problem because several built-in wordlists (e.g. the Surge profanity list) contain entries like c*nt, s.o.b., and pu$sy.

This caused two classes of bugs:

  • False positives — e.g. s.o.b. matching benign words like snobby (. matches any char).
  • False negatives — the literal obfuscated term never matching itself, e.g. pu$sy ($ acts as an anchor) or c*nt (* makes the preceding c optional).

The fix wraps the search string in re.escape() so metacharacters are matched literally:

if re.search(r"\b" + re.escape(s) + r"\b", output_text):

Verification

  • Added test_stringdetector_word_regex_metacharacters covering literal matching of s.o.b., pu$sy, and c*nt, including the false-positive/false-negative cases above.
  • Run the tests and ensure they pass python -m pytest tests/detectors/test_detectors_base.py

Signed-off-by: Bereket Deneke <bereketsiraw123@gmail.com>
@leondz

leondz commented Jul 6, 2026

Copy link
Copy Markdown
Collaborator

please fill in the PR description. marked as draft until ready

@leondz leondz marked this pull request as draft July 6, 2026 17:03
@bereketDeneke

Copy link
Copy Markdown
Author

please fill in the PR description. marked as draft until ready
PR description is filled-in!

@jmartin-tech jmartin-tech marked this pull request as ready for review July 7, 2026 13:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants