Skip to content
This repository has been archived by the owner on Sep 7, 2023. It is now read-only.

Fix quoting issue in search_operator plugin #3479

Merged
merged 2 commits into from Apr 5, 2023
Merged

Fix quoting issue in search_operator plugin #3479

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f3f058e
Fix quoting issue in search_operator plugin
glanham-jr Feb 19, 2023
acce623
Fix linting and typo
glanham-jr Apr 4, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
6 changes: 5 additions & 1 deletion searx/plugins/search_operators.py
View file
Open in desktop
Expand Up @@ -11,7 +11,11 @@

def on_result(request, search, result):
q = search.search_query.query
qs = shlex.split(q)
# WARN: shlex.quote is designed only for Unix shells and may be vulnerable
# to command injection on non-POSIX compliant shells (Windows)
# https://docs.python.org/3/library/shlex.html#shlex.quote
squote = shlex.quote(q)
qs = shlex.split(squote)
spitems = [x.lower() for x in qs if ' ' in x]
mitems = [x.lower() for x in qs if x.startswith('-')]
siteitems = [x.lower() for x in qs if x.startswith('site:')]
Expand Down