From fd5f6a74f1748592358d281fd93081c16bcc2271 Mon Sep 17 00:00:00 2001 From: surya Date: Mon, 6 Jul 2026 18:00:25 +0530 Subject: [PATCH] [fix]: correct encoded SYSTEM XXE regex matching The final branch of _XXE_INJECTION was missing % separators between hex pairs. Pattern %(?:25)?53(?:25)?59... never matched because after consuming %53 the next sub-pattern expected 5 or 2, not %. Fixed by inserting % anchors between each pair so both single-encoded (%53%59%53%54%45%4D) and double-encoded (%2553%2559...) SYSTEM strings match correctly. All existing XXE branches are unaffected. --- .../ai-threat-detection/backend/app/core/features/patterns.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/PROJECTS/advanced/ai-threat-detection/backend/app/core/features/patterns.py b/PROJECTS/advanced/ai-threat-detection/backend/app/core/features/patterns.py index 9b02a650..112f69fb 100644 --- a/PROJECTS/advanced/ai-threat-detection/backend/app/core/features/patterns.py +++ b/PROJECTS/advanced/ai-threat-detection/backend/app/core/features/patterns.py @@ -112,7 +112,7 @@ _XXE_INJECTION = ( r"xmlns\s*:\s*xi\s*=|" r"%(?:25)?3[Cc]!(?:ENTITY|DOCTYPE)|" r"&(?:xxe|xml|ext|file);|" - r"%(?:25)?(?:53|73)(?:25)?(?:59|79)(?:25)?(?:53|73)(?:25)?(?:54|74)(?:25)?(?:45|65)(?:25)?(?:4d|6d))") + r"%(?:25)?(?:53|73)%(?:25)?(?:59|79)%(?:25)?(?:53|73)%(?:25)?(?:54|74)%(?:25)?(?:45|65)%(?:25)?(?:4[Dd]))") _SSRF = ( r"(?:169\.254\.169\.254|"