From 570a87ec4fe72c23c68bbd3add02f9554a38190c Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Fri, 4 Sep 2026 01:51:26 +0000
Subject: [PATCH] Add control character regex validation to Pydantic string
 fields

---
 backend/app/schemas.py | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/backend/app/schemas.py b/backend/app/schemas.py
index d7c6de77d..ba73f80c9 100644
--- a/backend/app/schemas.py
+++ b/backend/app/schemas.py
@@ -190,7 +190,9 @@ class IndexRedundancyOut(BaseModel):
 class DiagramViewCreateIn(BaseModel):
     """Request body for saving an ERD canvas view."""
 
-    name: str = Field(min_length=1, max_length=200)
+    name: str = Field(
+        min_length=1, max_length=200, pattern=r"^[^\x00-\x1F\x7F]+$"
+    )
     # Opaque client layout (node positions, hidden tables, viewport). The API
     # bounds the serialized size in the endpoint to prevent abuse.
     layout_json: dict
@@ -214,8 +216,12 @@ class DiagramViewDetailOut(DiagramViewOut):
 class TableAnnotationUpsertIn(BaseModel):
     """Request body for creating/updating a table annotation."""
 
-    schema_name: str = Field(min_length=1, max_length=255)
-    relation_name: str = Field(min_length=1, max_length=255)
+    schema_name: str = Field(
+        min_length=1, max_length=255, pattern=r"^[^\x00-\x1F\x7F]+$"
+    )
+    relation_name: str = Field(
+        min_length=1, max_length=255, pattern=r"^[^\x00-\x1F\x7F]+$"
+    )
     body: str = Field(min_length=1, max_length=10_000)
 
 
@@ -302,7 +308,9 @@ class DbmlConvertOut(BaseModel):
 class ApiKeyCreateIn(BaseModel):
     """Request body for creating an API key."""
 
-    key_name: str = Field(min_length=1, max_length=128)
+    key_name: str = Field(
+        min_length=1, max_length=128, pattern=r"^[^\x00-\x1F\x7F]+$"
+    )
 
 
 class ApiKeyOut(BaseModel):