From 80c5620397ff708d8ff0aeb938d81ae9689e91bd Mon Sep 17 00:00:00 2001 From: Oliver Sand Date: Thu, 19 Aug 2021 18:58:51 +0200 Subject: [PATCH] Sanitize special characters before building search query for postgres Signed-off-by: Oliver Sand --- .changeset/eleven-snakes-give.md | 5 +++++ .../src/PgSearchEngine/PgSearchEngine.test.ts | 11 +++++++++++ .../src/PgSearchEngine/PgSearchEngine.ts | 2 +- 3 files changed, 17 insertions(+), 1 deletion(-) create mode 100644 .changeset/eleven-snakes-give.md diff --git a/.changeset/eleven-snakes-give.md b/.changeset/eleven-snakes-give.md new file mode 100644 index 0000000000..7c7a5724e6 --- /dev/null +++ b/.changeset/eleven-snakes-give.md @@ -0,0 +1,5 @@ +--- +'@backstage/plugin-search-backend-module-pg': patch +--- + +Sanitize special characters before building search query for postgres diff --git a/plugins/search-backend-module-pg/src/PgSearchEngine/PgSearchEngine.test.ts b/plugins/search-backend-module-pg/src/PgSearchEngine/PgSearchEngine.test.ts index 49fb169bf8..7bedee6dea 100644 --- a/plugins/search-backend-module-pg/src/PgSearchEngine/PgSearchEngine.test.ts +++ b/plugins/search-backend-module-pg/src/PgSearchEngine/PgSearchEngine.test.ts @@ -65,6 +65,17 @@ describe('PgSearchEngine', () => { }); }); + it('should sanitize query term', async () => { + const actualTranslatedQuery = searchEngine.translator({ + term: 'H&e|l!l*o W\0o(r)l:d', + pageCursor: '', + }) as PgSearchQuery; + + expect(actualTranslatedQuery).toMatchObject({ + pgTerm: '("Hello" | "Hello":*)&("World" | "World":*)', + }); + }); + it('should return translated query with filters', async () => { const actualTranslatedQuery = searchEngine.translator({ term: 'testTerm', diff --git a/plugins/search-backend-module-pg/src/PgSearchEngine/PgSearchEngine.ts b/plugins/search-backend-module-pg/src/PgSearchEngine/PgSearchEngine.ts index 0b052a499d..74a1e09010 100644 --- a/plugins/search-backend-module-pg/src/PgSearchEngine/PgSearchEngine.ts +++ b/plugins/search-backend-module-pg/src/PgSearchEngine/PgSearchEngine.ts @@ -50,7 +50,7 @@ export class PgSearchEngine implements SearchEngine { return { pgTerm: query.term .split(/\s/) - .map(p => p.trim()) + .map(p => p.replace(/[\0()|&:*!]/g, '').trim()) .filter(p => p !== '') .map(p => `(${JSON.stringify(p)} | ${JSON.stringify(p)}:*)`) .join('&'),