From 79ebfc92e9998cb67a270d888c4cd52b9d9973ed Mon Sep 17 00:00:00 2001
From: x032205 <x032205@gmail.com>
Date: Fri, 30 May 2025 18:01:49 -0400
Subject: [PATCH] RE2 for regex + input limits

---
 .../services/secret-sync/hc-vault/hc-vault-sync-schemas.ts    | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/backend/src/services/secret-sync/hc-vault/hc-vault-sync-schemas.ts b/backend/src/services/secret-sync/hc-vault/hc-vault-sync-schemas.ts
index d0f2a9f65..f9096ac71 100644
--- a/backend/src/services/secret-sync/hc-vault/hc-vault-sync-schemas.ts
+++ b/backend/src/services/secret-sync/hc-vault/hc-vault-sync-schemas.ts
@@ -16,12 +16,14 @@ const HCVaultSyncDestinationConfigSchema = z.object({
     .string()
     .trim()
     .min(1, "Secrets Engine Mount required")
+    .max(128)
     .describe(SecretSyncs.DESTINATION_CONFIG.HC_VAULT.mount),
   path: z
     .string()
     .trim()
     .min(1, "Path required")
-    .transform((val) => val.replace(/^\/+|\/+$/g, "")) // removes leading/trailing slashes
+    .max(128)
+    .transform((val) => new RE2("^/+|/+$", "g").replace(val, "")) // removes leading/trailing slashes
     .refine((val) => new RE2("^([a-zA-Z0-9._-]+/)*[a-zA-Z0-9._-]+$").test(val), {
       message:
         "Invalid Vault path format. Use alphanumerics, dots, dashes, underscores, and single slashes between segments."