Skip to content

Vue: validate search queries #40

Open
@rimutaka

Description

@rimutaka

A search query with unexpected input results in the hard error on the server and an error returned in GQL response.

E.g. searching for syst em returns ES query failed. See server logs. because it is failed here:

    // validate field_value for possible no-sql injection
    if NO_SQL_STRING_INVALIDATION_REGEX.is_match(&starts_with) {
        error!("Invalid starts_with: {}", starts_with);
        return Err(());
    }

The values should be validated on the client and then on the server before they even make it to ES part.

Relates to #30

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions