Skip to content

fix: escape special chars in db password regex character classes - #71

Open
Christian-Sidak wants to merge 1 commit into
Dokploy:mainfrom
Christian-Sidak:fix/issue-70
Open

Christian-Sidak wants to merge 1 commit into
Dokploy:mainfrom
Christian-Sidak:fix/issue-70

Conversation

@Christian-Sidak

Copy link
Copy Markdown

Summary

  • The database password fields across 15 database tools (libsql, mariadb, mongo, mysql, postgres, redis) used a regex pattern with characters that must be escaped when appearing bare inside a character class under strict ECMA-262 rules (the v / Unicode Sets flag): (, ), {, }, |, and [.
  • LLM provider tool-schema validators (Anthropic, OpenAI, DeepSeek, etc.) reject tools/list with "is not a regex" when any pattern field fails to compile as a valid ECMA-262 regex.
  • The fix escapes those characters in all 19 affected pattern occurrences across the generated files, and adds a sanitization step to generate-tools.ts so future pnpm generate runs always emit v-flag-valid patterns.

Changes

  • src/generated/openapi.json -- 19 pattern values updated (the committed snapshot of the upstream spec)
  • src/generated/tools.ts -- 19 corresponding Zod .regex() calls updated
  • scripts/generate-tools.ts -- added sanitizeRegexPattern() + sanitizeSchemaPatterns() helpers; applied during schema-to-Zod conversion so the fix is durable across future pnpm fetch-openapi && pnpm generate runs

The corrected pattern compiles under both the u and v flags and matches the same set of passwords as before (square brackets, curly braces, pipe, and parens are still accepted as password characters -- they just need to be escaped in the regex source).

Test plan

[x] All 45 existing tests pass (vitest run), including the "no tool inputSchema exposes patterns invalid under strict regex syntax" test that uses new RegExp(value, "v") to verify every exposed pattern.
[x] Verified the corrected pattern passes new RegExp(pattern, "v") and new RegExp(pattern, "u") in Node.js.
[x] Verified the regex still correctly allows passwords with [, ], {, }, |, (, ) and rejects passwords with spaces.
[x] No competing open PRs for this issue (checked before starting).

Fixes #70

The database password patterns contained several characters that are
only valid as literals inside a regex character class when escaped
under strict ECMA-262 rules (the 'v' / Unicode Sets flag):

  [ ( ) { } |

These appeared unescaped in the OpenAPI spec and in the generated
Zod schemas, causing LLM provider tool-schema validators to reject
the entire tools/list response with "is not a regex" errors.

Changes:
- Fix src/generated/openapi.json: escape all 19 occurrences of the
  bad pattern across the libsql, mariadb, mongo, mysql, postgres and
  redis database tools.
- Fix src/generated/tools.ts: same 19 occurrences in the committed
  generated file.
- Fix scripts/generate-tools.ts: add sanitizeRegexPattern() /
  sanitizeSchemaPatterns() so future pnpm generate runs always emit
  v-flag-valid patterns, preventing regressions when the OpenAPI spec
  is re-fetched from upstream.

The corrected pattern compiles under both the 'u' and 'v' flags while
matching the same set of passwords as before.

Fixes Dokploy#70

Signed-off-by: Christian Sidak <christian@sentineltech.eu>
Signed-off-by: Christian-Sidak <61099993+Christian-Sidak@users.noreply.github.com>
@Christian-Sidak

Copy link
Copy Markdown
Author

Friendly bump -- let me know if anything needs changing.

@Christian-Sidak

Copy link
Copy Markdown
Author

The fix makes the password regex patterns valid ECMA-262 Unicode Sets regexes by escaping (, ), {, }, |, and [ inside character classes, so LLM tool-schema validators (Anthropic, OpenAI, and similar) no longer reject the tools/list response. Happy to add a test case covering a password that contains one of these characters if that would help the review.

@Christian-Sidak

Copy link
Copy Markdown
Author

Following up on this. The regex escaping ensures the password pattern is valid ECMA-262 Unicode Sets syntax so tool-schema validators don't reject the tools/list response. The fix has been sitting a while - happy to add a test case covering a raw-password-with-special-chars input if that would help move it forward.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Invalid regex in generated tool schemas ([ unescaped inside character class) — MCP unusable with LLM clients that strictly validate tool schemas

1 participant