From 7a24af6e77eabfedce1570d9fd79ad90e94f6045 Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Thu, 3 Sep 2026 01:56:35 +0000
Subject: [PATCH 1/3] fix(security): add control character validation to
 schemas

---
 backend/app/schemas.py | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/backend/app/schemas.py b/backend/app/schemas.py
index d7c6de77d..84bc3bb38 100644
--- a/backend/app/schemas.py
+++ b/backend/app/schemas.py
@@ -190,7 +190,7 @@ class IndexRedundancyOut(BaseModel):
 class DiagramViewCreateIn(BaseModel):
     """Request body for saving an ERD canvas view."""
 
-    name: str = Field(min_length=1, max_length=200)
+    name: str = Field(min_length=1, max_length=200, pattern=r"^[^\x00-\x1F\x7F]+$")
     # Opaque client layout (node positions, hidden tables, viewport). The API
     # bounds the serialized size in the endpoint to prevent abuse.
     layout_json: dict
@@ -214,8 +214,12 @@ class DiagramViewDetailOut(DiagramViewOut):
 class TableAnnotationUpsertIn(BaseModel):
     """Request body for creating/updating a table annotation."""
 
-    schema_name: str = Field(min_length=1, max_length=255)
-    relation_name: str = Field(min_length=1, max_length=255)
+    schema_name: str = Field(
+        min_length=1, max_length=255, pattern=r"^[^\x00-\x1F\x7F]+$"
+    )
+    relation_name: str = Field(
+        min_length=1, max_length=255, pattern=r"^[^\x00-\x1F\x7F]+$"
+    )
     body: str = Field(min_length=1, max_length=10_000)
 
 
@@ -302,7 +306,7 @@ class DbmlConvertOut(BaseModel):
 class ApiKeyCreateIn(BaseModel):
     """Request body for creating an API key."""
 
-    key_name: str = Field(min_length=1, max_length=128)
+    key_name: str = Field(min_length=1, max_length=128, pattern=r"^[^\x00-\x1F\x7F]+$")
 
 
 class ApiKeyOut(BaseModel):

From 8a8f3f972200b5d6b37f6f95615db27d0ec10e8a Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Thu, 3 Sep 2026 02:05:51 +0000
Subject: [PATCH 2/3] fix(security): add control character validation to
 schemas


From 566b2056826a3e78804a144d2fe8a1defc4c72d6 Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Thu, 3 Sep 2026 15:08:38 +0000
Subject: [PATCH 3/3] fix(security): add control character validation to
 schemas