Skip to content

Fix(pattern_match): prevent false positive when valid regex doesn't match#274

Open
Jean-Regis-M wants to merge 1 commit intoGenAI-Security-Project:mainfrom
Jean-Regis-M:patch-23
Open

Fix(pattern_match): prevent false positive when valid regex doesn't match#274
Jean-Regis-M wants to merge 1 commit intoGenAI-Security-Project:mainfrom
Jean-Regis-M:patch-23

Conversation

@Jean-Regis-M
Copy link

Summary

Fixes #129
Adds an early return for the case where a valid regex finds no match, preventing fallthrough to a literal substring check that could cause false positives.

Problem

When is_regex=True and the regex is valid but finds no match, _matches_pattern proceeds to a literal substring search using the raw regex string. If the text contains that raw string (e.g., the pattern appears literally), the function incorrectly returns (True, matched_text).

Root Cause

In _matches_pattern, after the regex search block (try/except), there is no explicit return for the “valid regex, no match” case. Execution falls through to the literal search logic, which treats the pattern as a plain substring.

Solution

Added return False, None inside the try block after checking for a match. This ensures that a valid regex with no matches returns immediately, bypassing the literal fallback. Invalid regex still falls through to literal matching (existing behavior).

Impact

  • No breaking changes
  • Minimal diff (one line added)
  • Eliminates false positives for the described scenario
  • All existing tests pass

Testing

  • Added test case PRM-PAT-028 (provided in issue) passes.
  • Ran all existing pattern match tests; they continue to pass.
  • Manual verification of invalid regex fallback remains intact.

…atch

Root cause: _matches_pattern lacks early return for valid regex with no
match, causing fallthrough to literal substring check. If text contains
the raw regex pattern as literal characters, it incorrectly returns True.

Solution: Add `return False, None` after regex search attempt when no
match is found. This ensures valid regex with no match returns False
without falling back to literal matching. Invalid regex still falls back
to literal (existing behavior).

Impact: Fixes false positive for case where literal regex string appears
in text. No breaking changes, minimal diff, preserves existing behavior
for all other cases.

Signed-off-by: JEAN REGIS <240509606@firat.edu.tr>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Bug_032_EVALUATE: Test Case PRM-PAT-028 _matches_pattern returns false positive when valid regex does not match but pattern appears literally in text

1 participant