FIX: Validate replacement templates in SearchReplaceConverter

pyrit/converter/search_replace_converter.py

@@ -27,7 +27,9 @@ def __init__(self, *, pattern: str, replace: str | list[str], regex_flags: int =
 
         Raises:
             ValueError: If ``pattern`` is not a string or contains invalid regex syntax,
-                ``replace`` is not a string or non-empty list of strings, or ``regex_flags`` is not an integer.
+                ``replace`` is not a string or non-empty list of strings,
+                any replacement template in ``replace`` is invalid for ``pattern``,
+                or ``regex_flags`` is not an integer.
         """
         if not isinstance(pattern, str):
             raise ValueError("pattern must be a string.")
@@ -51,6 +53,12 @@ def __init__(self, *, pattern: str, replace: str | list[str], regex_flags: int =
         else:
             raise ValueError("replace must be a string or a non-empty list of strings.")
 
+        for replacement in self._replace_list:
+            try:
+                self._compiled_regex.sub(replacement, "")
+            except (re.error, IndexError) as e:
+                raise ValueError(f"Invalid regex replacement template in replace: {e}") from e
+
         self._pattern = pattern
         self._regex_flags = regex_flags
 

tests/unit/converter/test_search_replace_converter.py

@@ -88,6 +88,17 @@ def test_search_replace_invalid_regex_flags(invalid_flags):
         SearchReplaceConverter(pattern="hello", replace="world", regex_flags=invalid_flags)
 
 
+@pytest.mark.parametrize("invalid_template", [r"C:\Users\admin", r"\1", r"\g<foo>"])
+def test_search_replace_invalid_replacement_template(invalid_template):
+    with pytest.raises(ValueError, match="Invalid regex replacement template in replace"):
+        SearchReplaceConverter(pattern="PLACEHOLDER", replace=invalid_template)
+
+
+def test_search_replace_valid_replacement_template():
+    converter = SearchReplaceConverter(pattern=r"(?P<name>\w+)", replace=r"\g<name>")
+    assert converter._replace_list == [r"\g<name>"]
+
+
 def test_search_replace_build_identifier():
     converter = SearchReplaceConverter(pattern="test", replace=["A", "B"], regex_flags=re.IGNORECASE)
     identifier = converter._build_identifier()