[BUG]: Comma in table filter leads to backend error

[cv5ch]

Version Information

1.0-rainbow4

Hashcat

No response

Description

As seen in the screenshot below, the backend throws an error, if you enter a filter string containing a comma. This is because the backend requires one element for the __icontains filter in inc/apiv2/common/AbstractBaseAPI.php line 1200.

How should we go ahead?

• We could allow more than one filter string by the backend or
• stay at allowing only one and implement a better error message

How should we go ahead?

• Allow more than one filter string by the backend?
• Allow only one and implement a better error message?

[gluafamichl]

No matter how we decide, there must be a validation on frontend and backend for invalid input.

I prefer one filter, with several filters we will run in the "and" and "or" filter decision.

[cv5ch]

As only __in and __nin operators allow a list of multiple values, my suggestion is to separate the values only for __in and __nin filter operators and treat the comma as normal part of the filter string for all other operators:

diff --git a/src/inc/apiv2/common/AbstractBaseAPI.php b/src/inc/apiv2/common/AbstractBaseAPI.php
--- a/src/inc/apiv2/common/AbstractBaseAPI.php
+++ b/src/inc/apiv2/common/AbstractBaseAPI.php
@@ -1139,8 +1139,10 @@
         throw new HttpForbidden("Filter parameter '" . $filter . "' is not valid (key not valid field)");
       };
       
-      $valueList = explode(",", $value);
-      
+      // Only __in and __nin support comma-separated multiple values;
+      // all other operators treat the value as a literal string.
+      $isListOperator = in_array($matches['operator'], ['__in', '__nin']);
+      $valueList = $isListOperator ? explode(",", $value) : [$value];
       // TODO Merge/Combine with validate parameters
       foreach ($valueList as &$value) {
         switch ($features[$cast_key]['type']) {