Uploaded image for project: 'Magnolia Templating Essentials'
  1. Magnolia Templating Essentials
  2. MTE-149

Searchfn.searchPages does not escape illegal characters

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Neutral Neutral
    • None
    • 2.0.2
    • models
    • None

      Steps to reproduce

      1. Use searchfn.searchPages with searchTerm="("
      2. See Exception in Log

      Caused by: javax.jcr.RepositoryException: Exception building query: org.apache.lucene.queryParser.ParseException: Cannot parse '(': Encountered "<EOF>" at line 1, column 7.
      Was expecting one of:
          <AND> ...
          <OR> ...
          <NOT> ...
          "+" ...
          "-" ...
          "(" ...
          ")" ...
          "*" ...
          "^" ...
          <QUOTED> ...
          <TERM> ...
          <FUZZY_SLOP> ...
          <PREFIXTERM> ...
          <WILDTERM> ...
          "[" ...
          "{" ...
          <NUMBER> ...

              at org.apache.jackrabbit.core.query.lucene.LuceneQueryBuilder.createQuery(LuceneQueryBuilder.java:244) ~[jackrabbit-core-2.20.4.jar:2.20.4]
              at org.apache.jackrabbit.core.query.lucene.QueryImpl.execute(QueryImpl.java:109) ~[jackrabbit-core-2.20.4.jar:2.20.4]
              at org.apache.jackrabbit.core.query.QueryImpl$1.perform(QueryImpl.java:132) ~[jackrabbit-core-2.20.4.jar:2.20.4]
              at org.apache.jackrabbit.core.query.QueryImpl$1.perform(QueryImpl.java:129) ~[jackrabbit-core-2.20.4.jar:2.20.4]
              at org.apache.jackrabbit.core.session.SessionState.perform(SessionState.java:216) ~[jackrabbit-core-2.20.4.jar:2.20.4]
              at org.apache.jackrabbit.core.query.QueryImpl.execute(QueryImpl.java:128) ~[jackrabbit-core-2.20.4.jar:2.20.4]
              at info.magnolia.templating.functions.SearchTemplatingFunctions.searchContent(SearchTemplatingFunctions.java:163) ~[magnolia-templating-essentials-models-2.0.1.jar:?]
              at info.magnolia.templating.functions.SearchTemplatingFunctions.searchPages(SearchTemplatingFunctions.java:123) ~[magnolia-templating-essentials-models-2.0.1.jar:?]

      Expected results

      Special characters in searchTerm should be escaped in order to prevent any JCR2SQL-Injection and Exceptions.

      Actual results

      Exception as listed above.

      Workaround

      Reimplement the function and using JCR-SQL2 and binding the parameter using 

      bindValue-Function.

      Development notes

        Acceptance criteria

              Unassigned Unassigned
              krueegg Kurt Rüegg
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated:

                  Bug DoR
                  Task DoD