From bda38116da6e2475553da4f2e620c99689654606 Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Sat, 5 Sep 2026 22:08:58 +0000
Subject: [PATCH 1/2] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[MEDIUM?=
 =?UTF-8?q?]=20ERD=20=EC=8B=9D=EB=B3=84=EC=9E=90=20=EA=B8=B8=EC=9D=B4=20?=
 =?UTF-8?q?=EC=A0=9C=ED=95=9C=EC=9D=84=20=ED=86=B5=ED=95=9C=20ReDoS=20?=
 =?UTF-8?q?=EC=B7=A8=EC=95=BD=EC=A0=90=20=EC=88=98=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .jules/sentinel.md               | 5 +++++
 packages/web/src/lib/erd.test.ts | 8 ++++++++
 packages/web/src/lib/erd.ts      | 5 +++++
 3 files changed, 18 insertions(+)

diff --git a/.jules/sentinel.md b/.jules/sentinel.md
index 7902c442..59eee08b 100644
--- a/.jules/sentinel.md
+++ b/.jules/sentinel.md
@@ -30,3 +30,8 @@
 **Vulnerability:** Known high-severity vulnerabilities discovered by the audit in `js-yaml` and `nanoid` packages.
 **Learning:** Deeply nested dependencies (`js-yaml` via `eslint`, `nanoid` via `vitest/vite`) may expose the application to DoS or logic loops.
 **Prevention:** Use `pnpm.overrides` in the root `package.json` to enforce patched versions across all transitive paths in a pnpm workspace.
+
+## 2025-02-18 - Missing Length Limit causing ReDoS (Regex DoS)
+**Vulnerability:** The `assertSnakeCaseIdentifier` function used a regular expression to validate table and column names without a prior length limit constraint, which allowed maliciously long identifiers to exhaust CPU resources resulting in a DoS.
+**Learning:** Checking string formats using regular expressions, particularly those with unbounded repetitions or complex back-tracking behaviors on mismatched inputs, without setting string length bounds first is highly risky. Attackers can exploit this by submitting excessively large strings.
+**Prevention:** Enforce string length boundaries, especially prior to passing inputs into regex validation or complex string processing.
diff --git a/packages/web/src/lib/erd.test.ts b/packages/web/src/lib/erd.test.ts
index b40a8008..06102cc9 100644
--- a/packages/web/src/lib/erd.test.ts
+++ b/packages/web/src/lib/erd.test.ts
@@ -141,6 +141,14 @@ describe("ERDModel", () => {
       ).toThrowError("Column 'created__at' must be snake_case.");
     });
 
+    it("should reject identifiers exceeding length limit", () => {
+      model.addTable("users");
+      const longName = "a".repeat(65);
+      expect(() =>
+        model.addColumn("users", { name: longName, type: "integer" }),
+      ).toThrowError("Invalid length for Column identifier.");
+    });
+
     it("should reject invalid SQL default values", () => {
       model.addTable("users");
       expect(() =>
diff --git a/packages/web/src/lib/erd.ts b/packages/web/src/lib/erd.ts
index 0cc436c4..5f48e670 100644
--- a/packages/web/src/lib/erd.ts
+++ b/packages/web/src/lib/erd.ts
@@ -62,7 +62,12 @@ function assertSafeSqlDefaultValue(value: string): void {
   }
 }
 
+const MAX_IDENTIFIER_LENGTH = 64;
+
 function assertSnakeCaseIdentifier(kind: string, name: string): void {
+  if (name.length === 0 || name.length > MAX_IDENTIFIER_LENGTH) {
+    throw new Error(`Invalid length for ${kind} identifier.`);
+  }
   if (!SNAKE_CASE_IDENTIFIER.test(name)) {
     throw new Error(`${kind} '${name}' must be snake_case.`);
   }

From bf44d2e30dcdfae673f0b5ec9ba4f1f251b7f813 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sun, 6 Sep 2026 09:36:11 +0900
Subject: [PATCH 2/2] chore: keep Sentinel guidance scoped to protected
 baseline

---
 .jules/sentinel.md | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/.jules/sentinel.md b/.jules/sentinel.md
index 59eee08b..7902c442 100644
--- a/.jules/sentinel.md
+++ b/.jules/sentinel.md
@@ -30,8 +30,3 @@
 **Vulnerability:** Known high-severity vulnerabilities discovered by the audit in `js-yaml` and `nanoid` packages.
 **Learning:** Deeply nested dependencies (`js-yaml` via `eslint`, `nanoid` via `vitest/vite`) may expose the application to DoS or logic loops.
 **Prevention:** Use `pnpm.overrides` in the root `package.json` to enforce patched versions across all transitive paths in a pnpm workspace.
-
-## 2025-02-18 - Missing Length Limit causing ReDoS (Regex DoS)
-**Vulnerability:** The `assertSnakeCaseIdentifier` function used a regular expression to validate table and column names without a prior length limit constraint, which allowed maliciously long identifiers to exhaust CPU resources resulting in a DoS.
-**Learning:** Checking string formats using regular expressions, particularly those with unbounded repetitions or complex back-tracking behaviors on mismatched inputs, without setting string length bounds first is highly risky. Attackers can exploit this by submitting excessively large strings.
-**Prevention:** Enforce string length boundaries, especially prior to passing inputs into regex validation or complex string processing.