feat(patients): escape string in appointments search (#2031)

Fix #1997
Fix #2003
Fix #1999
Fix #2029

src/__tests__/clients/db/AppointmentRepository.test.ts

@@ -1,5 +1,5 @@
 import AppointmentRepository from 'clients/db/AppointmentRepository'
-import { appointments } from 'config/pouchdb'
+import { appointments, patients } from 'config/pouchdb'
 import Appointment from 'model/Appointment'
 
 const uuidV4Regex = /^[A-F\d]{8}-[A-F\d]{4}-4[A-F\d]{3}-[89AB][A-F\d]{3}-[A-F\d]{12}$/i
@@ -24,6 +24,21 @@ describe('Appointment Repository', () => {
     })
   })
 
+  describe('searchPatientAppointments', () => {
+    it('should escape all special chars from search text', async () => {
+      await patients.put({ _id: 'id2222' })
+      await appointments.put({ _id: 'id3333', patientId: 'id2222', location: 'id-]?}(){*[$+.^\\' })
+
+      const result = await AppointmentRepository.searchPatientAppointments(
+        'id2222',
+        'id-]?}(){*[$+.^\\',
+      )
+
+      expect(result).toHaveLength(1)
+      expect(result[0].id).toEqual('id3333')
+    })
+  })
+
   describe('save', () => {
     it('should create an id that is a uuid', async () => {
       const newAppointment = await AppointmentRepository.save({

src/clients/db/AppointmentRepository.ts

@@ -1,3 +1,4 @@
+import escapeStringRegexp from 'escape-string-regexp'
 import Appointment from 'model/Appointment'
 import { appointments } from 'config/pouchdb'
 import Repository from './Repository'
@@ -9,6 +10,7 @@ export class AppointmentRepository extends Repository<Appointment> {
 
   // Fuzzy search for patient appointments. Used for patient appointment search bar
   async searchPatientAppointments(patientId: string, text: string): Promise<Appointment[]> {
+    const escapedString = escapeStringRegexp(text)
     return super.search({
       selector: {
         $and: [
@@ -19,17 +21,17 @@ export class AppointmentRepository extends Repository<Appointment> {
             $or: [
               {
                 location: {
-                  $regex: RegExp(text, 'i'),
+                  $regex: RegExp(escapedString, 'i'),
                 },
               },
               {
                 reason: {
-                  $regex: RegExp(text, 'i'),
+                  $regex: RegExp(escapedString, 'i'),
                 },
               },
               {
                 type: {
-                  $regex: RegExp(text, 'i'),
+                  $regex: RegExp(escapedString, 'i'),
                 },
               },
             ],