diff --git a/.changeset/eleven-snakes-give.md b/.changeset/eleven-snakes-give.md new file mode 100644 index 0000000000..7c7a5724e6 --- /dev/null +++ b/.changeset/eleven-snakes-give.md @@ -0,0 +1,5 @@ +--- +'@backstage/plugin-search-backend-module-pg': patch +--- + +Sanitize special characters before building search query for postgres diff --git a/plugins/search-backend-module-pg/src/PgSearchEngine/PgSearchEngine.test.ts b/plugins/search-backend-module-pg/src/PgSearchEngine/PgSearchEngine.test.ts index 49fb169bf8..7bedee6dea 100644 --- a/plugins/search-backend-module-pg/src/PgSearchEngine/PgSearchEngine.test.ts +++ b/plugins/search-backend-module-pg/src/PgSearchEngine/PgSearchEngine.test.ts @@ -65,6 +65,17 @@ describe('PgSearchEngine', () => { }); }); + it('should sanitize query term', async () => { + const actualTranslatedQuery = searchEngine.translator({ + term: 'H&e|l!l*o W\0o(r)l:d', + pageCursor: '', + }) as PgSearchQuery; + + expect(actualTranslatedQuery).toMatchObject({ + pgTerm: '("Hello" | "Hello":*)&("World" | "World":*)', + }); + }); + it('should return translated query with filters', async () => { const actualTranslatedQuery = searchEngine.translator({ term: 'testTerm', diff --git a/plugins/search-backend-module-pg/src/PgSearchEngine/PgSearchEngine.ts b/plugins/search-backend-module-pg/src/PgSearchEngine/PgSearchEngine.ts index 0b052a499d..74a1e09010 100644 --- a/plugins/search-backend-module-pg/src/PgSearchEngine/PgSearchEngine.ts +++ b/plugins/search-backend-module-pg/src/PgSearchEngine/PgSearchEngine.ts @@ -50,7 +50,7 @@ export class PgSearchEngine implements SearchEngine { return { pgTerm: query.term .split(/\s/) - .map(p => p.trim()) + .map(p => p.replace(/[\0()|&:*!]/g, '').trim()) .filter(p => p !== '') .map(p => `(${JSON.stringify(p)} | ${JSON.stringify(p)}:*)`) .join('&'),