adding allowlist regex validator before interpolation + tests

[davidsbatista]

Related Issues

• fixes deepset-ai/haystack-private#428

Proposed Changes:

• adds an allowlist regex ^[A-Za-z_][A-Za-z0-9_]*$ validated against the field identifier before it is interpolated into the query.
• any field name that does not match raises a FilterError, closing the injection surface

How did you test it?

Added unit tests to test_convert_filters_errors covering:

• The exact PoC payload from the issue report (tenant = $p0, false) OR true RETURN d //)
• Semicolon injection (x; DROP DATABASE)
• Dot-separated identifiers (x.y, meta.x.y)
• Empty identifier after meta. stripping (meta.)
• Digit-leading identifiers (2fast)
• Hyphen-containing identifiers (created-by, meta.created-by)

Checklist

• I have read the contributors guidelines and the code of conduct
• I have updated the related issue with new insights and changes
• I added unit tests and updated the docstrings
• I've used one of the conventional commit types for my PR title: fix:, feat:, build:, chore:, ci:, docs:, style:, refactor:, perf:, test:.

[github-actions]

Coverage report (falkordb)

Click to see where and how coverage changed

File	Statements	Missing	Coverage	Coverage (new stmts)	Lines missing
integrations/falkordb/src/haystack_integrations/document_stores/falkordb
document_store.py
Project Total

This report was generated by python-coverage-comment-action

[sjrl]

Looks good!