Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Escape Regexps in search query by default #134

Open
FunkyloverOne opened this issue Nov 5, 2018 · 0 comments
Open

Escape Regexps in search query by default #134

FunkyloverOne opened this issue Nov 5, 2018 · 0 comments

Comments

@FunkyloverOne
Copy link

FunkyloverOne commented Nov 5, 2018

Guys, don't you think it's better to have query string "regexp-escaped" by-default in your example initializer from README?

This is what you have there now:

  ## Match partial words on both sides (slower)
  config.regex = Proc.new { |query| /#{query}/ }

  ## Match partial words on the beginning or in the end (slightly faster)
  # config.regex = Proc.new { |query| /^#{query}/ }
  # config.regex = Proc.new { |query| /#{query}$/ }

And I could have just query like this: ...., and it will match anything that has at least 4 characters. Well this is quite simple example, but I believe it could lead to a lot of unwanted (and not obvious) results.

I believe it's better to replace what you currently have with this:

  ## Match partial words on both sides (slower)
  config.regex = Proc.new { |query| /#{::Regexp.escape(query)}/ }

  ## Match partial words on the beginning or in the end (slightly faster)
  # config.regex = Proc.new { |query| /^#{::Regexp.escape(query)}/ }
  # config.regex = Proc.new { |query| /#{::Regexp.escape(query)}$/ }

UPDATE
It does not change anything actually, for some reason. Quite strange, it works in regular scopes though.


UPDATE 2
OK, I see that you're actually already escaping keywords here:

escaped_kw = Regexp.escape(kw)

but it actually has no effect for me on mongoid 6.4.2. So I believe it's a bug.

@FunkyloverOne FunkyloverOne changed the title Escape Regexps in search Escape Regexps in search query by default Nov 5, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant