Fix security hotspots, pass a timeout to limit the execution time

PxWeb/Code/Api2/DataSelection/SelectionHandler.cs

@@ -57,7 +57,7 @@ public SelectionHandler(IPxApiConfigurationService configOptionsService)
                 //Add variables that the user did not post
                 variablesSelection = AddVariables(variablesSelection, builder.Model);
 
-                //Map VariablesSelection to PCaxis.Paxiom.Selection[] 
+                //Map VariablesSelection to PCaxis.Paxiom.Selection[]
                 selections = MapCustomizedSelection(builder, builder.Model, variablesSelection).ToArray();
             }
             else
@@ -410,7 +410,7 @@ private bool VerifyWildcardQuestionmarkExpression(string expression)
         /// <returns>True if the expression is valid, else false</returns>
         private bool VerifyTopExpression(string expression)
         {
-            return Regex.IsMatch(expression, REGEX_TOP, RegexOptions.IgnoreCase);
+            return Regex.IsMatch(expression, REGEX_TOP, RegexOptions.IgnoreCase, TimeSpan.FromMilliseconds(100));
         }
 
         /// <summary>
@@ -420,7 +420,7 @@ private bool VerifyTopExpression(string expression)
         /// <returns>True if the expression is valid, else false</returns>
         private bool VerifyBottomExpression(string expression)
         {
-            return Regex.IsMatch(expression, REGEX_BOTTOM, RegexOptions.IgnoreCase);
+            return Regex.IsMatch(expression, REGEX_BOTTOM, RegexOptions.IgnoreCase, TimeSpan.FromMilliseconds(100));
         }
 
         /// <summary>
@@ -430,7 +430,7 @@ private bool VerifyBottomExpression(string expression)
         /// <returns>True if the expression is valid, else false</returns>
         private bool VerifyRangeExpression(string expression)
         {
-            return Regex.IsMatch(expression, REGEX_RANGE, RegexOptions.IgnoreCase);
+            return Regex.IsMatch(expression, REGEX_RANGE, RegexOptions.IgnoreCase, TimeSpan.FromMilliseconds(100));
         }
 
         /// <summary>
@@ -440,7 +440,7 @@ private bool VerifyRangeExpression(string expression)
         /// <returns>True if the expression is valid, else false</returns>
         private bool VerifyFromExpression(string expression)
         {
-            return Regex.IsMatch(expression, REGEX_FROM, RegexOptions.IgnoreCase);
+            return Regex.IsMatch(expression, REGEX_FROM, RegexOptions.IgnoreCase, TimeSpan.FromMilliseconds(100));
         }
 
         /// <summary>
@@ -450,7 +450,7 @@ private bool VerifyFromExpression(string expression)
         /// <returns>True if the expression is valid, else false</returns>
         private bool VerifyToExpression(string expression)
         {
-            return Regex.IsMatch(expression, REGEX_TO, RegexOptions.IgnoreCase);
+            return Regex.IsMatch(expression, REGEX_TO, RegexOptions.IgnoreCase, TimeSpan.FromMilliseconds(100));
         }
 
         /// <summary>
@@ -692,15 +692,15 @@ private void AddWildcardStarValues(Variable variable, bool aggregatedSingle, Lis
         private void AddWildcardQuestionmarkValues(Variable variable, bool aggregatedSingle, List<string> values, string wildcard)
         {
             string regexPattern = string.Concat("^", Regex.Escape(wildcard).Replace("\\?", "."), "$");
-            var variableValues = variable.Values.Where(v => Regex.IsMatch(v.Code, regexPattern, RegexOptions.IgnoreCase)).Select(v => v.Code);
+            var variableValues = variable.Values.Where(v => Regex.IsMatch(v.Code, regexPattern, RegexOptions.IgnoreCase, TimeSpan.FromMilliseconds(100))).Select(v => v.Code);
             foreach (var variableValue in variableValues)
             {
                 AddValue(variable, aggregatedSingle, values, variableValue);
             }
         }
 
         /// <summary>
-        /// Add values for variable based on TOP(xxx) and TOP(xxx,yyy) selection expression. 
+        /// Add values for variable based on TOP(xxx) and TOP(xxx,yyy) selection expression.
         /// </summary>
         /// <param name="variable">Paxiom variable</param>
         /// <param name="aggregatedSingle">Indicates if single values from aggregation groups shall be added</param>
@@ -733,7 +733,7 @@ private void AddTopValues(Variable variable, bool aggregatedSingle, List<string>
         }
 
         /// <summary>
-        /// Add values for variable based on BOTTOM(xxx) and BOTTOM(xxx,yyy) selection expression. 
+        /// Add values for variable based on BOTTOM(xxx) and BOTTOM(xxx,yyy) selection expression.
         /// </summary>
         /// <param name="variable">Paxiom variable</param>
         /// <param name="aggregatedSingle">Indicates if single values from aggregation groups shall be added</param>
@@ -772,7 +772,7 @@ private void AddBottomValues(Variable variable, bool aggregatedSingle, List<stri
         }
 
         /// <summary>
-        /// Add values for variable based on RANGE(xxx,yyy) selection expression. 
+        /// Add values for variable based on RANGE(xxx,yyy) selection expression.
         /// </summary>
         /// <param name="variable">Paxiom variable</param>
         /// <param name="aggregatedSingle">Indicates if single values from aggregation groups shall be added</param>
@@ -817,7 +817,7 @@ private void AddRangeValues(Variable variable, bool aggregatedSingle, List<strin
         }
 
         /// <summary>
-        /// Add values for variable based on FROM(xxx) selection expression. 
+        /// Add values for variable based on FROM(xxx) selection expression.
         /// </summary>
         /// <param name="variable">Paxiom variable</param>
         /// <param name="aggregatedSingle">Indicates if single values from aggregation groups shall be added</param>
@@ -851,7 +851,7 @@ private void AddFromValues(Variable variable, bool aggregatedSingle, List<string
         }
 
         /// <summary>
-        /// Add values for variable based on TO(xxx) selection expression. 
+        /// Add values for variable based on TO(xxx) selection expression.
         /// </summary>
         /// <param name="variable">Paxiom variable</param>
         /// <param name="aggregatedSingle">Indicates if single values from aggregation groups shall be added</param>
@@ -971,7 +971,7 @@ private bool GetRangeCodes(string expression, out string code1, out string code2
 
         /// <summary>
         /// Find index of code in code array.
-        /// First tries to find code as specified. If it is not found the method tries to find the code in a case insensitive way. 
+        /// First tries to find code as specified. If it is not found the method tries to find the code in a case insensitive way.
         /// </summary>
         /// <param name="codes">Array of codes</param>
         /// <param name="code">Code to find index for</param>

PxWeb/Code/Api2/ModelBinder/QueryStringToDictionaryOfStrings.cs

@@ -32,7 +32,7 @@ Task IModelBinder.BindModelAsync(ModelBindingContext bindingContext)
                     string? q = bindingContext.HttpContext.Request.Query[key];
                     if (q != null)
                     {
-                        var items = Regex.Split(q, ",(?=[^\\]]*(?:\\[|$))");
+                        var items = Regex.Split(q, ",(?=[^\\]]*(?:\\[|$))", RegexOptions.None, TimeSpan.FromMilliseconds(100));
                         var itemsList = new List<string>();
                         foreach (var item in items)
                         {

PxWeb/Code/LanguageUtil.cs

@@ -8,7 +8,7 @@ public static bool HasValidLanguageCodePattern(string languageCode)
         {
             //Language code are either XX or XX-XX
             var pattern = @"^[a-z]{2}-[a-z]{2}$|^[a-z]{2}$";
-            return Regex.IsMatch(languageCode, pattern, System.Text.RegularExpressions.RegexOptions.IgnoreCase);
+            return Regex.IsMatch(languageCode, pattern, System.Text.RegularExpressions.RegexOptions.IgnoreCase, TimeSpan.FromMilliseconds(100));
         }
 
         public static string SanitizeLangueCode(string languageCode)

PxWeb/Controllers/Api2/Admin/SearchindexController.cs

@@ -96,7 +96,7 @@ public IActionResult IndexDatabase([FromBody, Required] string[] tables)
                 {
                     List<string> languages = new List<string>();
                     List<string> tableList = tables
-                        .Select(table => Regex.Replace(table.Trim(), @"[^0-9a-zA-Z]+", ""))
+                        .Select(table => Regex.Replace(table.Trim(), @"[^0-9a-zA-Z]+", "", RegexOptions.None, TimeSpan.FromMilliseconds(100)))
                         .ToList();
 
                     if (tableList.Count == 0)

PxWeb/Filters/Api2/BasePathFilter.cs

@@ -42,7 +42,7 @@ public void Apply(OpenApiDocument swaggerDoc, DocumentFilterContext context)
             {
                 if (path.Key.StartsWith(this.BasePath))
                 {
-                    string newKey = Regex.Replace(path.Key, $"^{this.BasePath}", string.Empty);
+                    string newKey = Regex.Replace(path.Key, $"^{this.BasePath}", string.Empty, RegexOptions.None, TimeSpan.FromMilliseconds(100));
                     swaggerDoc.Paths.Remove(path.Key);
                     swaggerDoc.Paths.Add(newKey, path.Value);
                 }