fix(server): escape ILIKE pattern in evaluator-configs list endpoint#108
Merged
lan17 merged 1 commit intoagentcontrol:mainfrom Mar 11, 2026
Merged
Conversation
The name filter in list_evaluator_configs used raw user input in the ILIKE pattern, causing SQL wildcards (% and _) in search terms to be interpreted as pattern characters instead of literals. This is inconsistent with the agents and controls list endpoints which both use escape_like_pattern(). Apply the same escaping already used by the other two endpoints. Made-with: Cursor
lan17
approved these changes
Mar 11, 2026
Contributor
There was a problem hiding this comment.
Thank you for fixing !
@Ritvik777 can you sign your commit in this pr and then we can merge?
lan17
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The name filter in list_evaluator_configs used raw user input in the
ILIKE pattern, causing SQL wildcards (% and _) in search terms to be
interpreted as pattern characters instead of literals. This is
inconsistent with the agents and controls list endpoints which both
use escape_like_pattern().
Apply the same escaping already used by the other two endpoints.
Summary
endpoint name filter, matching the existing behavior in agents and
controls list endpoints.
Scope
GET /api/v1/evaluator-configs?name=...now treats
%and_as literal characters instead of SQL wildcards.escape_like_patternimport and applied itto both the results query and the total count query in
evaluator_configs.py.correct).
Risk and Rollout
Testing
make check(or explained why not)Checklist