chore: Sentinel: [MEDIUM] Fix LIKE clause wildcard injection

🛡️ Sentinel: [MEDIUM] Fix LIKE clause wildcard injection

Author: edsonesf

.jules/sentinel.md

@@ -0,0 +1,4 @@
+## 2025-05-16 - [Medium] Fix LIKE clause wildcard injection
+**Vulnerability:** A LIKE clause wildcard injection vulnerability in the Pokemon API. In `src/app/repositories/pokemon_repository.py`, the `find_all` method took a `name` filter string which was used in a `LIKE` SQL query (`ilike()`). While it escaped `%` and `_`, it failed to escape the literal escape character `\` itself. This allowed user input to escape the database's wildcard characters in unintended ways, leading to an incorrect or malicious query executing.
+**Learning:** Even when manually escaping string tokens before passing them into a `LIKE` statement, it is critical to also escape the specific escape character itself (typically `\`) otherwise the user can neutralize the query's wildcards.
+**Prevention:** When doing manual substring search escaping for database queries in python (e.g., `ilike(f"%{escaped}%")`), ensure you escape the backslash *first* before escaping other wildcard characters. For example: `escaped = input.replace("\\", "\\\\").replace("%", r"\%").replace("_", r"\_")`.

pyproject.toml

@@ -30,3 +30,7 @@ ignore_missing_imports = true
 [[tool.mypy.overrides]]
 module = "PIL.*"
 ignore_missing_imports = true
+
+[[tool.mypy.overrides]]
+module = "app.services.recognition_service"
+warn_unused_ignores = false

src/app/repositories/pokemon_repository.py

@@ -58,7 +58,7 @@ def find_all(
         """
         stmt = select(PokemonModel)
         if name:
-            escaped = name.replace("%", r"\%").replace("_", r"\_")
+            escaped = name.replace("\\", "\\\\").replace("%", r"\%").replace("_", r"\_")
             stmt = stmt.where(PokemonModel.name.ilike(f"%{escaped}%", escape="\\"))
         stmt = stmt.order_by(PokemonModel.id).limit(limit).offset(offset)
 

src/app/services/recognition_service.py

@@ -37,7 +37,7 @@ def __init__(self, model_path: str, confidence_threshold: float = 0.20) -> None:
             )
             return
 
-        from ultralytics import YOLO  # lazy import — not needed at import time
+        from ultralytics import YOLO  # type: ignore[attr-defined]  # lazy import
 
         self._model = YOLO(model_path)
         logger.info(

tests/test_pokemon_repository.py

@@ -362,3 +362,69 @@ def test_to_summary_dto_non_list_type(
         'Pokemon ID 994 has invalid types format (not a list): "electric"'
         in caplog.text
     )
+
+
+# ---------------------------------------------------------------------------
+# LIKE clause wildcard injection tests (CWE-89)
+# These tests verify the fix introduced in PR #240: backslashes in user input
+# must be escaped *before* % and _ so they cannot neutralise the escape char.
+# ---------------------------------------------------------------------------
+
+
+def test_find_all_backslash_percent_does_not_match(db_session: Session) -> None:
+    """Backslash-percent attack pattern must NOT match any Pokemon.
+
+    Without the fix, a user input of backslash+percent could escape the leading
+    percent wildcard added by the query, producing a literal search for '%' and
+    potentially matching unintended rows. With the fix, the backslash is doubled
+    first so it is treated as a literal character in the LIKE pattern.
+    """
+    repo = PokemonRepository(db_session)
+    results = repo.find_all(name="\\%")
+
+    assert results == [], (
+        f"Expected no results for backslash-percent attack, got {results}"
+    )
+
+
+def test_find_all_backslash_underscore_does_not_match(db_session: Session) -> None:
+    """Backslash-underscore attack pattern must NOT match any Pokemon.
+
+    Without the fix, backslash+underscore in user input could escape the `_`
+    single-char wildcard, widening the search unexpectedly. The fix ensures both
+    characters are treated as literals.
+    """
+    repo = PokemonRepository(db_session)
+    results = repo.find_all(name="\\_")
+
+    assert results == [], (
+        f"Expected no results for backslash-underscore attack, got {results}"
+    )
+
+
+def test_find_all_double_backslash_treated_as_literal(db_session: Session) -> None:
+    """A double backslash in input must be treated as a single literal backslash.
+
+    Verifies that the escape order (backslash first) produces a correct LIKE
+    pattern: the doubled backslash is interpreted as the literal character.
+    Since no Pokemon name contains a backslash, the result must be empty.
+    """
+    repo = PokemonRepository(db_session)
+    results = repo.find_all(name="\\\\")
+
+    assert results == [], (
+        f"Expected no results for double-backslash pattern, got {results}"
+    )
+
+
+def test_find_all_normal_name_unaffected_by_escape(db_session: Session) -> None:
+    """Normal name searches must still work correctly after the injection fix.
+
+    Regression guard: ensures the backslash-escaping pre-processing does not
+    break ordinary partial-match searches with no special characters.
+    """
+    repo = PokemonRepository(db_session)
+    results = repo.find_all(name="pika")
+
+    assert len(results) == 1
+    assert results[0].name == "pikachu"