Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Vue: validate search queries #40

Open
rimutaka opened this issue Jun 12, 2022 · 0 comments
Open

Vue: validate search queries #40

rimutaka opened this issue Jun 12, 2022 · 0 comments
Labels
bug Something isn't working

Comments

@rimutaka
Copy link
Member

rimutaka commented Jun 12, 2022

A search query with unexpected input results in the hard error on the server and an error returned in GQL response.

E.g. searching for syst em returns ES query failed. See server logs. because it is failed here:

    // validate field_value for possible no-sql injection
    if NO_SQL_STRING_INVALIDATION_REGEX.is_match(&starts_with) {
        error!("Invalid starts_with: {}", starts_with);
        return Err(());
    }

The values should be validated on the client and then on the server before they even make it to ES part.

Relates to #30

@rimutaka rimutaka added the bug Something isn't working label Jun 12, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant