fix(jsonfilter): Sanitize input when parsing filters

[javirln]

This pull request strengthens the security of JSON field path filtering in workflow queries by validating user-supplied field paths to prevent SQL injection. It introduces a strict allowlist for field path syntax, surfaces validation errors to the API, and adds comprehensive tests to ensure only safe paths are accepted.

Security improvements for JSON field path filtering:

• Added a regular expression (fieldPathRegexp) in pkg/jsonfilter/jsonfilter.go to strictly validate JSON field paths, allowing only dot-separated identifiers and numeric array indices, and rejecting any unsafe characters that could lead to SQL injection.
• Implemented the validateFieldPath function in pkg/jsonfilter/jsonfilter.go to enforce this validation before building SQL predicates. [1] [2]
• Updated BuildEntSelectorFromJSONFilter to return an error if the field path is unsafe, preventing unsafe queries from being constructed.

Workflow query logic and error handling:

• Refactored applyWorkflowFilters in app/controlplane/pkg/data/workflow.go to return an error if any JSON filter is invalid, ensuring validation errors are surfaced instead of silently ignored. [1] [2] [3] [4]
• Updated integration tests in app/controlplane/pkg/biz/workflow_integration_test.go to verify that unsafe field paths are rejected with a validation error, and safe paths are accepted.

Test coverage:

• Expanded unit tests in pkg/jsonfilter/jsonfilter_test.go to cover a wide range of valid and invalid field path scenarios, ensuring the validator correctly allows safe paths and rejects unsafe ones. [1] [2]

Other:

• Updated copyright years in pkg/jsonfilter/jsonfilter.go.
• Added missing import for jsonfilter in integration tests.

[cubic-dev-ai]

No issues found across 4 files

_{Re-trigger cubic}

[migmartri]

How did you find this?