Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Filters are not escaped #269

Closed
NightJar opened this issue Nov 7, 2019 · 2 comments
Closed

Filters are not escaped #269

NightJar opened this issue Nov 7, 2019 · 2 comments

Comments

@NightJar
Copy link
Contributor

NightJar commented Nov 7, 2019

$components = array_merge(
$this->getRequireFiltersComponent($searchQuery),
$this->getExcludeFiltersComponent($searchQuery)
);

Filters added to a search query are not sanitised
Exclusions added to a search query are sanitised

This is confusing and not a good experience, as a developer must escape some classnames and no others when consuming the API to perform a search.

@emteknetnz
Copy link
Member

emteknetnz commented Apr 3, 2020

This should be fairly easy,

    public function sanitiseClassName($className, $replaceWith = '\\\\')
    {
        return str_replace('\\', $replaceWith, $className);
    }

Update this to detect if there's any double escaping about to happen i.e. strpos($str, '\\\\') !== false , to prevent break existing sites that are adding ->sanitiseClassName in their custom code e.g. #247 (comment)

Then just add $this->sanitiseClassName() to getRequireFiltersComponent()

Remember to include unit tests

@dhensby
Copy link
Contributor

dhensby commented Apr 3, 2020

This is a duplicate of #247

@dhensby dhensby closed this as completed Apr 3, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants