Add input validation to prevent Solr injection in query construction

[Copilot]

The _execute_solr_query method constructs Solr queries by directly joining query parts without validation. While current usage only passes internal strings, this pattern creates injection risk if user-controlled data is added later.

Changes

• Added _validate_solr_query_part(): Validates query parts against shell injection patterns (;, ${...}, backticks, command chaining) and Solr-specific attacks (LocalParams {!...}, XSS vectors)

• Added _validate_solr_field_name(): Restricts field names to [a-zA-Z0-9_-]+ to prevent injection through field parameters

• Modified _execute_solr_query(): Validates all query parts and field names before query construction, returns empty list on validation failure

# Before: Direct string concatenation
query_string = " AND ".join(query_parts)

# After: Validated inputs
for part in query_parts:
    if not self._validate_solr_query_part(part):
        return []
query_string = " AND ".join(query_parts)

All existing queries pass validation. Defense-in-depth approach protects against future modifications.

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.

[alexdryden]

This isn't a real issue since we are only ever passing in params defined in the code.