fix(security): 2 improvements across 2 files

[tomaioo]

Summary

fix(security): 2 improvements across 2 files

Problem

Severity: Medium | File: etils/epy/re_utils.py:L58

In etils/epy/re_utils.py, the _pattern_cache function converts f-string patterns to regex patterns by replacing {name} with (?P<name>.+). However, if the input pattern contains other special regex characters (e.g., ., *, ?, [], (), etc.), they are passed directly to re.compile without escaping. This can lead to unexpected regex behavior, performance issues (ReDoS), or incorrect matching. While the primary use case is controlled patterns, if user input is ever passed to reverse_fstring, it could be exploited. Additionally, the .+ quantifier is greedy and may cause catastrophic backtracking with certain inputs.

Solution

Escape the literal parts of the pattern before substituting named groups. Consider using re.escape() on the static parts of the pattern, or validate that the pattern only contains expected f-string placeholders. Also consider using [^/]+ or a more specific character class instead of .+ to reduce ReDoS risk.

Changes

• etils/epy/re_utils.py (modified)
• etils/ecolab/highlight_util.py (modified)

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.