[fas89]

Python's $ also matches just before a final newline, so re.match(r"^[a-z]+$", "orders\n") succeeds and the caller goes on to use "orders\n". #788 closed this in providers/_sql_safety.py. This PR sweeps the rest of fluid_build/ for the same shape: a whole-string allowlist ending in $, used with .match or .search, on input that can carry a trailing newline.

Inputs like that are easy to produce. A YAML | block scalar ends in one, so do many .env values, and parse_qs decodes %0A.

What changed

• 31 patterns now end in \Z. Five more are matched with fullmatch at their call sites:

  • the catalog quoting chokepoint, which also covers the BigQuery patterns callers pass in;
  • bigquery._validate_ident;
  • the federation workspace id, whose error message prints the pattern.

  The sites cover quality-check selectors, catalog and JDBC identifiers, BigQuery and GCP project ids, contract, build, federation-workspace and overlay-env ids, row-filter names, Singer tap and target names, prompt profile and overlay names, mission predicate paths, AWS and GCP resource names, Snowflake account segments, Databricks git refs, and the ODCS and ODPS import checks. The last two compile the bundled schema's $ patterns.

• An AWS binding region with whitespace around it is refused (kind: aws-region-whitespace). Neither of the obvious alternatives is safe:

  • Dropping it leaves the provider on the environment's region and skips _guard_region_move.
  • Pinning it stripped applies a region the sovereignty policy never checked. Both sovereignty checkers compare the value as written, so "us-east-1\n" passes deniedRegions: [us-east-1].

• Messages show the refused newline. The AWS name and mission-path refusal messages now use repr.

• Docstrings and changelog. The validate_id docstring is updated, and CHANGELOG gets an entry under Unreleased / Security.

Before, seen through the CLI on clean origin/main:

• fluid generate iac wrote provider.aws = {"region": "eu-west-1\n"}.
• A Databricks job got git_source.branch = "main\n" from ?branch=main%0A.

Now:

❌ unsupported_binding  [ERR_UNSUPPORTED_BINDING]
  kind: aws-region-whitespace
  error: exposes[sales_transactions] binding.location.region is 'eu-west-1\n': a region code with whitespace around it. ...
  remediation: ["Write the region alone: region: eu-west-1 (a YAML '|' block ends the value in a newline)."]

  kind: databricks-job-git-ref
  error: builds[0] (transform) repository names branch 'main\n', which is not a valid Git ref.

What stays

81 other $-ending patterns are left as they are, each for a reason:

• 7 already use fullmatch.
• 29 strip or normalize their input first, and the stripped value is what they use.
• 4 are fed a derived value that cannot end in \n.
• 9 are deny lists or detectors, where \Z would loosen the check.
• 26 are parsers or substitutions where $ guards no input (\s*$, MULTILINE, captured groups only).
• 2 are judgment calls:
  • Snowflake quote_identifier quotes and never refuses.
  • The dbt _recency_window passes a duration verbatim, and \Z would drop a window every downstream parser reads.

Prior art (borrow-before-build)

• No existing rule covers this. ruff, bandit and pylint have none. CodeQL only has py/regex/unmatchable-dollar, a different defect. The semgrep registry rule check-validation-regex is Ruby/Rails only.
• Same fix elsewhere:
  • Django's username validators: ticket 30257, $ changed to \Z.
  • The MCP Python SDK's tool-name check: fix: reject trailing newline in tool-name validation modelcontextprotocol/python-sdk#3076, fullmatch.
• Why \Z and not \z: \z arrives only in Python 3.14, and this repo supports 3.10 and later.

Validation

• New tests. tests/security/test_trailing_newline_anchors.py has 46 cases. Each pins one site with a value and the same value plus "\n". All 46 fail on a clean origin/main checkout, each on its newline assertion, and all 46 pass here.
• Touched-module suites:
  • On the sweep commit: 10225 passed, 0 failed across the 243 test files that reference a changed module.
  • On the final tree, the test files of every module the review fixes touched: 1775 passed, 0 failed (51 files).
• Gates: ruff check fluid_build/ tests/, the CI dead-code gate, black==24.10.0 --check, product guardrail, license headers, lint-imports (6 kept), mypy-strict hotspots, bandit, and detect-secrets 1.5.0 on the changed files all pass.
• Known local-only red: tests/perf/test_startup_budget.py fails 3 tests in this local venv. It fails the same 3, with identical module counts, on clean origin/main. The diff adds no import.

Reviews (/ship)

• security-review. The first pass found no findings. A re-review of an interim strip variant found a MEDIUM: the deniedRegions bypass described above. It is fixed by the refusal, and the final re-review found no findings.
• world-class-inspection, scoped to this diff:
  • Docs: CONCERNS, 2 × P3 (changelog count, docstring). Fixed.
  • Codebase: CONCERNS, P2 (the region strip) and P3 (bigquery._validate_ident). Fixed.
  • Tests: CONCERNS, P2 (_validate_ident unpinned) and P3 (AWS_ENDPOINT_URL_* env leak). Fixed.
  • Architecture: PASS.
  • Persistence and Web: N/A.
  • UX (CLI): refusals name the value with repr and a remediation.
• defect-scan.
  • REAL_BUG, both fixed: the AWS region drop/strip, and bigquery._validate_ident.
  • UX, fixed: messages that hid the newline.
  • NOT_A_BUG: the native quality engine refuses "id\n" while the SodaCL exporter strips it. That divergence pre-dates this PR, and native already failed on main.

Follow-ups (not in this PR)

• The JSON-schema pattern keyword has the same gap. jsonschema runs re.search, so fluid validate accepts id: "orders\n" and plan/apply now refuse it later. A separate change is in progress.
• A guard so the class cannot come back, as a ratchet test or a semgrep rule.
• Validate contract and build ids before the OpenTofu apply. An id that passes the schema but fails _ids is refused only after infrastructure is applied. That pre-dates this PR for leading-digit and over-128-character ids.
• _recency_window should strip and return, as odcs/mappers/sla.py does.

Documentation

• No docs needed — this change does not affect user-facing behaviour
  • Justification: no documented command, flag or schema field changes. A value that ends in a newline, which no documented identifier, name or region rule allows, is now refused, with the validator's existing message showing the newline. An AWS binding region with whitespace around it now fails fluid generate iac / fluid apply with kind: aws-region-whitespace. The CHANGELOG Security entry records both.

[github-actions]

📄 Documentation Reminder

This PR appears to be missing a documentation reference. Our docs live in a separate repo.

Please update the PR description with one of:

• Link a docs PR — check the "Docs PR linked" box and paste the URL
• Mark as no docs needed — check "No docs needed" with a justification
• Acknowledge docs TODO — check "Docs TODO" and create the docs PR before merge

See the Contributing Guide for details.