From 70506f490d39513984515be9d325cf59a9e8d4a4 Mon Sep 17 00:00:00 2001 From: Peter Thomassen <4242683+peterthomassen@users.noreply.github.com> Date: Tue, 18 Aug 2026 16:44:32 +0200 Subject: [PATCH 1/3] Update filtering.md: Add warning about crafted regex filter inputs Thanks to @syrull for making the team aware. --- docs/api-guide/filtering.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/docs/api-guide/filtering.md b/docs/api-guide/filtering.md index 8f20ad0262..9ef17081ce 100644 --- a/docs/api-guide/filtering.md +++ b/docs/api-guide/filtering.md @@ -227,7 +227,7 @@ The search behavior may be specified by prefixing field names in `search_fields` | ------ | --------------| ------------------ | | `^` | `istartswith` | Starts-with search.| | `=` | `iexact` | Exact matches. | -| `$` | `iregex` | Regex search. | +| `$` | `iregex` | Regex search (see warning below). | | `@` | `search` | Full-text search (Currently only supported Django's [PostgreSQL backend][postgres-search]). | | None | `icontains` | Contains search (Default). | @@ -237,6 +237,9 @@ For example: By default, the search parameter is named `'search'`, but this may be overridden with the `SEARCH_PARAM` setting in the `REST_FRAMEWORK` configuration. +!!! + When passing a regex to the filter via the `$` prefix, beware of maliciously crafted regular expressions that may lead to excessive CPU consumption and Denial of Service. Ensure regex inputs are trusted, and familiarize yourself with risky patterns (e.g., catastrophic backtracking). + #### Accent-insensitive search The `UnaccentedSearchFilter` subclass performs accent-insensitive matching, so that a search for `Jeremy` also matches `Jérémy`. It behaves like `SearchFilter`, except the lookups are wrapped with the `unaccent` transform: the default lookup becomes `unaccent__icontains`, `^` becomes `unaccent__istartswith`, `=` becomes `unaccent__iexact`, and `$` becomes `unaccent__iregex`. The `@` (full-text search) prefix is left unchanged, as the `unaccent` transform cannot be combined with a full-text search lookup. From 37da0a5392b0d7d36f9ba4d5a3ce7984a3a61a87 Mon Sep 17 00:00:00 2001 From: Peter Thomassen <4242683+peterthomassen@users.noreply.github.com> Date: Tue, 18 Aug 2026 16:57:50 +0200 Subject: [PATCH 2/3] fixup Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- docs/api-guide/filtering.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/api-guide/filtering.md b/docs/api-guide/filtering.md index 9ef17081ce..e2d3b408c1 100644 --- a/docs/api-guide/filtering.md +++ b/docs/api-guide/filtering.md @@ -237,8 +237,8 @@ For example: By default, the search parameter is named `'search'`, but this may be overridden with the `SEARCH_PARAM` setting in the `REST_FRAMEWORK` configuration. -!!! - When passing a regex to the filter via the `$` prefix, beware of maliciously crafted regular expressions that may lead to excessive CPU consumption and Denial of Service. Ensure regex inputs are trusted, and familiarize yourself with risky patterns (e.g., catastrophic backtracking). +!!! warning + When passing a regex to the filter via the `$` prefix, beware of maliciously crafted regular expressions that may lead to excessive CPU consumption and denial of service (DoS). Consider avoiding regex search for untrusted clients, and familiarize yourself with risky patterns (e.g., catastrophic backtracking). #### Accent-insensitive search From 1f0a98437746c9915a25ba180a970451d45818ab Mon Sep 17 00:00:00 2001 From: Peter Thomassen <4242683+peterthomassen@users.noreply.github.com> Date: Tue, 18 Aug 2026 16:59:48 +0200 Subject: [PATCH 3/3] fixup --- docs/api-guide/filtering.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/api-guide/filtering.md b/docs/api-guide/filtering.md index e2d3b408c1..705a580215 100644 --- a/docs/api-guide/filtering.md +++ b/docs/api-guide/filtering.md @@ -238,7 +238,7 @@ For example: By default, the search parameter is named `'search'`, but this may be overridden with the `SEARCH_PARAM` setting in the `REST_FRAMEWORK` configuration. !!! warning - When passing a regex to the filter via the `$` prefix, beware of maliciously crafted regular expressions that may lead to excessive CPU consumption and denial of service (DoS). Consider avoiding regex search for untrusted clients, and familiarize yourself with risky patterns (e.g., catastrophic backtracking). + When passing a regex to the filter via the `$` prefix or performing a `iregex` lookup, beware of maliciously crafted regular expressions that may lead to excessive CPU consumption and denial of service (DoS). Consider avoiding regex search for untrusted clients, and familiarize yourself with risky patterns (e.g., catastrophic backtracking). #### Accent-insensitive search