From 5f013ea173a781fe18580372036bf0e75adf401c Mon Sep 17 00:00:00 2001
From: rustmailer <pollybase@zohomail.com>
Date: Thu, 5 Mar 2026 16:41:30 +0800
Subject: [PATCH] add regex pattern validation via DuckDB

---
 src/modules/duckdb/init.rs    | 15 +++++++++++++++
 src/modules/message/search.rs | 12 ++++++++++++
 2 files changed, 27 insertions(+)

diff --git a/src/modules/duckdb/init.rs b/src/modules/duckdb/init.rs
index a56add2..b14e5fe 100644
--- a/src/modules/duckdb/init.rs
+++ b/src/modules/duckdb/init.rs
@@ -99,6 +99,21 @@ impl DuckDBManager {
         Ok(())
     }
 
+    pub fn validate_regex(&self, pattern: &str) -> BichonResult<()> {
+        let conn = self.conn()?;
+        let check_sql = "SELECT regexp_matches('', ?)";
+        if let Err(e) = conn
+            .prepare(check_sql)
+            .and_then(|mut stmt| stmt.execute([pattern]))
+        {
+            return Err(raise_error!(
+                format!("Invalid Regular Expression for DuckDB: {}", e).into(),
+                ErrorCode::InvalidParameter
+            ));
+        }
+        Ok(())
+    }
+
     pub fn delete_envelopes_by_account(&self, account_id: u64) -> BichonResult<usize> {
         let mut conn = self.conn()?;
         let tx = conn
diff --git a/src/modules/message/search.rs b/src/modules/message/search.rs
index 2e2fa8a..80882c9 100644
--- a/src/modules/message/search.rs
+++ b/src/modules/message/search.rs
@@ -23,6 +23,7 @@ use serde::{Deserialize, Serialize};
 
 use crate::{
     modules::{
+        duckdb::init::duckdb,
         error::{code::ErrorCode, BichonResult},
         indexer::{envelope::Envelope, manager::ENVELOPE_INDEX_MANAGER},
         rest::response::DataPage,
@@ -78,6 +79,17 @@ impl SearchRequest {
                 ErrorCode::InvalidParameter
             ));
         }
+
+        if let Some(ref pattern) = self.filter.text {
+            if let Err(_) = duckdb()?.validate_regex(pattern) {
+                return Err(raise_error!(
+                    "Invalid search pattern: The regular expression is not supported by DuckDB."
+                        .into(),
+                    ErrorCode::InvalidParameter
+                ));
+            }
+        }
+
         Ok(())
     }
 }