Correct regular expression range

[LantaoJin]

Description

Regular expression [A-z] also matches the characters: [ \ ] ^ _ `. It may have overly permissive range risk. Correct it with [a-zA-Z_].

Issues Resolved

Resolves https://github.com/opensearch-project/sql/security/code-scanning/8

Check List

• [-] New functionality includes testing.
  • All tests pass, including unit test, integration test and doctest
• [-] New functionality has been documented.
  • [-] New functionality has javadoc added
  • [-] New functionality has user manual doc added
• Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[dai-chen]

Thanks for the fix!

Just wonder previously this this a mistake instead of by design? Is it possible cx has such pattern that become illegal after this PR?

[LantaoJin]

Thanks for the fix!

Just wonder previously this this a mistake instead of by design? Is it possible cx has such pattern that become illegal after this PR?

For backward compatibility, we can fix the security issue to add all characters: [ \ ] ^ _ ` to pattern. But it means we set them by design. @dai-chen

[dai-chen]

Thanks for the fix!
Just wonder previously this this a mistake instead of by design? Is it possible cx has such pattern that become illegal after this PR?

For backward compatibility, we can fix the security issue to add all characters: [ \ ] ^ _ ` to pattern. But it means we set them by design. @dai-chen

Got it. Feel free to merge. Thanks!