Security: Fix 5 remaining ReDoS alerts by bounding regex repetition and input length

Author: rahuldass19

src/qwed_new/core/fact_verifier.py

@@ -212,25 +212,42 @@ def verify_fact(
     # Sentence Segmentation
     # =========================================================================
 
-    def _segment_sentences(self, text: str) -> List[Tuple[str, int, int]]:
-        """
-        Segment text into sentences with their positions.
-        
-        Returns:
-            List of (sentence, start_index, end_index)
-        """
-        # Simple sentence boundary detection
-        # Handles: period, question mark, exclamation, followed by space and capital
-        sentence_pattern = r'(?<=[.!?])\s+(?=[A-Z])'
+        if len(text) > 100000:
+            text = text[:100000]  # Hard cap to prevent ReDoS on massive inputs
+            
+        # Optimized sentence boundary: avoid lookbehind/ahead complexity if possible
+        # Standard ReDoS-safe pattern for English sentences
+        # Limit the whitespace match to avoid catastrophic backtracking
+        sentence_pattern = r'[.!?]\s{1,50}(?=[A-Z])'
 
         sentences = []
         current_pos = 0
-        parts = re.split(sentence_pattern, text)
+        
+        # Using split with a simpler pattern is safer
+        # Find all delimiters first
+        matches = list(re.finditer(sentence_pattern, text))
+        
+        last_end = 0
+        for match in matches:
+            end = match.end() - 1 # Keep the delimiter with the sentence usually, or adjust
+            # Actually, re.split behavior is tricky to replicate exactly safely
+            # Let's use the pattern but with a limit
+            pass
+            
+        # Reverting to re.split but with SAFE regex
+        # The issue was \s+ which is unbounded. \s{1,50} limits backtracking.
+        safe_pattern = r'(?<=[.!?])\s{1,50}(?=[A-Z])'
+        
+        parts = re.split(safe_pattern, text)
 
         for part in parts:
             part = part.strip()
             if part:
+                # Find the part in text efficiently
                 start = text.find(part, current_pos)
+                if start == -1:
+                    # Fallback if strip() messed up strict finding
+                     start = current_pos
                 end = start + len(part)
                 sentences.append((part, start, end))
                 current_pos = end

src/qwed_new/core/image_verifier.py

@@ -394,9 +394,18 @@ def _verify_size_claim(
         """
         claim_lower = claim.lower()
 
+        # Extract dimension numbers from claim (various formats)
+        if len(claim) > 500:
+             return ImageVerificationResult(
+                verdict="INCONCLUSIVE",
+                confidence=0.0,
+                reasoning="Claim too long for size verification"
+            )
+
         # Extract dimension numbers from claim (various formats)
         # Matches: "1x1", "100×200", "is 1x1 pixels", "800 x 600", etc.
-        dimension_match = re.search(r'(\d+)\s*[×x]\s*(\d+)', claim)
+        # FIX: Replaced \s* with \s{0,5} to limit backtracking
+        dimension_match = re.search(r'(\d+)\s{0,5}[×x]\s{0,5}(\d+)', claim)
         if dimension_match:
             claimed_width = int(dimension_match.group(1))
             claimed_height = int(dimension_match.group(2))
@@ -420,8 +429,9 @@ def _verify_size_claim(
 
         # Check for single dimension - more flexible patterns
         # Matches: "width is 1", "The width is 500", "width of 100", "width: 100"
-        width_match = re.search(r'width\s*(?:is|of|:)?\s*(\d+)', claim_lower)
-        height_match = re.search(r'height\s*(?:is|of|:)?\s*(\d+)', claim_lower)
+        # FIX: Replaced \s* and \s+ with bounded \s{0,5} and \s{1,5}
+        width_match = re.search(r'width\s{0,5}(?:is|of|:)?\s{0,5}(\d+)', claim_lower)
+        height_match = re.search(r'height\s{0,5}(?:is|of|:)?\s{0,5}(\d+)', claim_lower)
 
         if width_match and metadata.width > 0:
             claimed = int(width_match.group(1))