From 8797bfcde76c686390cf6f66127c20392ab77bdd Mon Sep 17 00:00:00 2001 From: Agniva De Sarker Date: Fri, 9 Sep 2022 21:21:34 +0530 Subject: [PATCH] MM-46871: Add remining search parameters to be escaped (#20963) The first try wasn't exhaustive. I was planning to use https://github.com/mattermost/mattermost-server/blob/1f933263e76739e4e3f089b6cefbdbeb41dd29e4/store/sqlstore/post_store.go#L1738-L1748 for this but it also contained `@` which we don't want. In the end, I just used a separate slice for all the characters to be escaped. https://mattermost.atlassian.net/browse/MM-46871 ```release-note NONE ``` Co-authored-by: Mattermod --- store/sqlstore/user_store.go | 7 +++++-- store/storetest/user_store.go | 14 ++++++++++++++ 2 files changed, 19 insertions(+), 2 deletions(-) diff --git a/store/sqlstore/user_store.go b/store/sqlstore/user_store.go index b5b60c3d57..8a359ed870 100644 --- a/store/sqlstore/user_store.go +++ b/store/sqlstore/user_store.go @@ -1503,8 +1503,11 @@ func generateSearchQuery(query sq.SelectBuilder, terms []string, fields []string var dbSpecificTerm string if isPostgreSQL { - // Escaping the : in case of a Postgres search. - term = strings.ReplaceAll(term, ":", "\\:") + // Refer to https://www.postgresql.org/docs/current/functions-textsearch.html for the list of operators. + for _, c := range []string{":", "(", ")", "<", "!", "|"} { + // Escaping the special chars in case of a Postgres search. + term = strings.ReplaceAll(term, c, "\\"+c) + } } for _, field := range fields { diff --git a/store/storetest/user_store.go b/store/storetest/user_store.go index 14cde98222..cef2ce02e8 100644 --- a/store/storetest/user_store.go +++ b/store/storetest/user_store.go @@ -2807,6 +2807,20 @@ func testUserStoreSearch(t *testing.T, ss store.Store) { &model.UserSearchOptions{}, []*model.User{}, }, + { + "escape ( and )", + t1id, + "ji(bah)", + &model.UserSearchOptions{}, + []*model.User{}, + }, + { + "escape <", + t1id, + "ji(bah<", + &model.UserSearchOptions{}, + []*model.User{}, + }, { "wildcard search", t1id,