fix(search): guard non-finite _score in /api/es/search response (#36478)

[dsilvam]

Proposed Changes

Fixes #36478. Canonical fix on main; will be cherry-picked to release-26.07.06-01 after merge (per dotCMS backport convention).

• Coerce non-finite hit _score values (NaN/Infinity) to null in ESContentResourcePortlet.hitsToLegacyJson, restoring the pre-regression Elasticsearch-native wire format.
• Add a fast unit regression test (ESContentResourcePortletNaNScoreTest) covering NaN, Infinity, and finite scores.

Root cause

Regression introduced by #36398 (route /api/es/raw & /api/es/search through the phase-aware SearchAPI), first released in v26.07.04-01.

The endpoints now rebuild the legacy ES-wire response via dotCMS's com.dotmarketing.util.json.JSONObject instead of returning ES's native JSON. The per-hit score was written as a raw float:

.put("_score", hit.getScore())   // hit.getScore() can be Float.NaN

Elasticsearch returns a non-finite _score (NaN) for hits that are not relevance-scored — most commonly any query that sorts by a field (unless track_scores=true), plus filter/constant_score/aggregation-only contexts. JSONObject.put(...) runs testValidity(), which throws JSONException("JSON does not allow non-finite numbers.") on non-finite values → HTTP 500. The previous implementation returned SearchResponse.toString() (ES XContent), which serializes NaN as null, so the error did not occur before the cutover.

Impact was systemic and not content-related (reproducible on Production/Staging/UAT), affecting custom /api/es/search calls and built-in Site Search.

Fix

.put("_score", finiteOrNull(hit.getScore()))
...
private static Object finiteOrNull(final float value) {
    return Float.isFinite(value) ? Float.valueOf(value) : JSONObject.NULL;
}

No response-shape change for finite scores; a score that previously 500'd now serializes as "_score": null.

Checklist

• Tests — ESContentResourcePortletNaNScoreTest (3 tests, all passing): NaN → null, Infinity → null, finite score preserved.
• Translations — N/A (no user-facing strings).
• Security Implications Contemplated — none; no schema, index, or API-contract change.

Additional Info

Interim workaround for affected customers (no deploy): for client-controlled queries, add "track_scores": true to sorted queries so ES returns a finite score. Does not cover built-in Site Search — that is resolved by this patch.

Suggester score fields are unaffected: they carry only finite ES suggester scores and are not the reproduced path.

🤖 Generated with Claude Code

This PR fixes: #36478

[claude]

Claude finished @dsilvam's task in 12m 35s —— View job

---

🔍 dotCMS Backend Review

[🟡 Medium] dotCMS/src/test/java/com/dotcms/rest/elasticsearch/ESContentResourcePortletNaNScoreTest.java:5

Unused static import — fail is never invoked in any of the three test methods.

import static org.junit.Assert.fail;

💡 Remove the unused import.

---

[🟡 Medium] dotCMS/src/test/java/com/dotcms/rest/elasticsearch/ESContentResourcePortletNaNScoreTest.java

Test coverage gap: Float.NEGATIVE_INFINITY is not exercised — only POSITIVE_INFINITY and NaN are covered. Float.isFinite handles both correctly, so this isn't a production bug, but the class Javadoc explicitly claims "Positive/negative infinity is likewise coerced," which the test suite doesn't fully back up.

@Test
public void test_infinite_score_serializes_as_null() throws Exception {
    final JSONObject result = hitsToLegacyJson(hitsWithScore(Float.POSITIVE_INFINITY));
    ...
}

💡 Add a fourth @Test for Float.NEGATIVE_INFINITY for completeness.

---

Sub-agent results:

• Security: no issues found
• Database/Cache: no issues found (change is pure JSON serialization, no SQL/transaction/cache path)
• REST API: no issues found — finiteOrNull is a narrowly-scoped private helper; endpoint methods (search, searchPost, searchRawGet, searchRaw), their webResource.init() calls, @Schema annotations, and exception mapping are untouched and already handle JSONException via the existing generic catch block
• Java Standards: 2 minor nits above (unused import, test coverage gap) — no raw types, no System.out/System.getProperty misuse, no APILocator violations, logic in finiteOrNull is correct and matches JSONObject.testValidity's NaN/Infinity rejection

No Critical or High severity findings. The fix itself is correct and appropriately scoped.

Next steps

• 🟡 You can ask me to handle the two mechanical fixes inline: @claude fix the unused import and add a NEGATIVE_INFINITY test case in ESContentResourcePortletNaNScoreTest.java
• Every new push triggers a fresh review automatically

Note: I'm unable to submit a formal GitHub PR review (approve/request changes) per my configured capabilities. See the FAQ for more information.

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request