[Sharing NG] user/group search term does not work with special chars

[JammingBen]

Describe the bug

The server responds with a 400 error when requesting users/groups via the graph/v1.0/users (or graph/v1.0/groups) endpoint while using a search term that includes special characters.

Steps to reproduce

1. Create a group with the name test?
2. Search for this group with the search term test (https://host.docker.internal:9200/graph/v1.0/groups?%24search=test) -> works fine, the result will be the newly created group
3. Search for this group with the exact search term test? (https://host.docker.internal:9200/graph/v1.0/groups?%24search=test? or encoded - no difference https://host.docker.internal:9200/graph/v1.0/groups?%24search=test%3F) -> doesn't work

Expected behavior

The server responds with the newly created group test?.

Actual behavior

The server responds with a 400 error: Token '?' is invalid.

@rhafer am I missing something, or is this a valid issue?

[rhafer]

Hm, that's the github.com/CiscoM31/godata.TokenMatcher choking on the the ?. I am not whether that is actually a bug in go data or the ? needs any special escaping in odata. Still looking ...

[JammingBen]

Hm, that's the github.com/CiscoM31/godata.TokenMatcher choking on the the ?. I am not whether that is actually a bug in go data or the ? needs any special escaping in odata. Still looking ...

Don't know if it helps, but it pretty much happens with any special char. Also blanks, e.g. Albert%20Einstein or Albert+Einstein.

[rhafer]

Yeah, the parser only accepts word characters for search literals:
https://github.com/CiscoM31/godata/blame/master-intersight/search_parser.go#L47

That is probably too strict. But we'd need to check the ODATA spec to be sure.

[rhafer]

@JammingBen
Digging through https://docs.oasis-open.org/odata/odata/v4.01/cs01/abnf/odata-abnf-construction-rules.txt I just remembered that we already had a similar bug report (#7990).

The behavior of godata is actually correct. You need to quote the search phrase in double quotes if it contains anything else than word characters.

So https://host.docker.internal:9200/graph/v1.0/groups?$search="test?" should work. Which raises the question how to search for something containing ". The quick answer for that is: 🤷 . The spec isn't exactly enlightening on that.

[JammingBen]

The behavior of godata is actually correct. You need to quote the search phrase in double quotes if it contains anything else than word characters.

Thanks, this works perfectly fine!

So https://host.docker.internal:9200/graph/v1.0/groups?$search="test?" should work. Which raises the question how to search for something containing ". The quick answer for that is: 🤷 . The spec isn't exactly enlightening on that.

Hmm good point. While it's a valid concern, I'd be fine with leaving it unsolved for now since it's quite the edge case. Web actually has several tests including special characters, however none of them include ".