update

Career/Microlise/Session Stored XSS PENTEST.md

@@ -380,6 +380,60 @@ public static void SaveSearchCriteriaToSession(...)
 
     ^[0-9]{4}-(((0[13578]|(10|12))-(0[1-9]|[1-2][0-9]|3[0-1]))|(02-(0[1-9]|[1-2][0-9]))|((0[469]|11)-(0[1-9]|[1-2][0-9]|30)))$
 
+#### Explanation of regex:
+
+##### `SebDateRegex`
+
+`^[0-9]{4}-(((0[13578]|(10|12))-(0[1-9]|[1-2][0-9]|3[0-1]))|(02-(0[1-9]|[1-2][0-9]))|((0[469]|11)-(0[1-9]|[1-2][0-9]|30)))$`
+
+Overall shape: `YYYY-MM-DD` only — four digits, hyphen, month/day with structure checks.
+
+|Part|Meaning|
+|---|---|
+|`^` / `$`|Whole string must match (no extra characters).|
+|`[0-9]{4}-`|Four-digit year, then `-`.|
+|31-day months|`(0[13578]\|(10\|12))-(0[1-9]\|[1-2][0-9]\|3[0-1])` — Jan, Mar, May, Jul, Aug, Oct, Dec: day `01`–`31`.|
+|February|`02-(0[1-9]\|[1-2][0-9])` — day `01`–`29` (no Feb 30/31).|
+|30-day months|`(0[469]\|11)-(0[1-9]\|[1-2][0-9]\|30)` — Apr, Jun, Sep, Nov: day `01`–`30`.|
+
+Matches: `2026-05-27`, `2024-02-29`, `2024-04-30`  
+Rejects: `2026-13-01`, `not-a-date`, `"); alert(1);//`, empty/null
+
+Note: This is format validation, not a full calendar check. It does not prove the date exists (e.g. `2025-02-30` can match the February branch). That matches the existing client `DateValidation()` in `ScheduleExecutionBoard.aspx` (line 4050).
+
+#####  `SebTimeRegex`
+
+`^[0-2][0-9]:[0-5][0-9]$`
+
+Overall shape: two digits, `:`, two digits — same idea as `HH:mm` in the UI.
+
+|Part|Meaning|
+|---|---|
+|`[0-2][0-9]`|First hour digit 0–2, second 0–9 → allows `00`–`29` (looser than strict 00–23).|
+|`:`|Literal colon.|
+|`[0-5][0-9]`|Minutes `00`–`59`.|
+
+Matches: `00:00`, `12:30`, `23:59`  
+Rejects: `25:99`, `9:00` (needs two hour digits), `"); alert(1);//`
+
+Note: Values like `29:00` match the pattern but are not real clock times; the pentest/UI convention is this simple pattern, not full time-of-day logic.
+
+#####  `QueryComponentIdRegex`
+
+`^[0-9]+(\.X)?$`
+
+Overall shape: one or more digits, optionally followed by `.X` — the values SEB puts on search/order-by dropdowns.
+
+|Part|Meaning|
+|---|---|
+|`^` / `$`|Whole string only.|
+|`[0-9]+`|One or more digits (e.g. `0`, `123`).|
+|`(\.X)?`|Optional literal `.X` (shared / external query suffix in combo markup).|
+
+Matches: `0`, `0.X`, `123`, `123.X`  
+Rejects: `abc`, `0.XY`, `"); alert(1);//`, empty/null
+
+This aligns with how items are built in `BuildSearchForComboBoxItems` / `BuildOrderByComboBoxItems` (e.g. `"0.X"` for “all journeys” / unspecified order-by).
 ### Fix 3 — What not to do
 
   - Do not rely on client `DateValidation()` alone.