Enforce string query and mode search params

app/Http/Controllers/HomeController.php

@@ -125,7 +125,7 @@ public function opensearch()
 
     public function quickSearch()
     {
-        $quickSearch = new QuickSearch(request(), ['user' => auth()->user()]);
+        $quickSearch = new QuickSearch(Request::all(), ['user' => auth()->user()]);
         $searches = $quickSearch->searches();
 
         $result = [];
@@ -177,18 +177,20 @@ public function quickSearch()
      */
     public function search()
     {
-        if (request('mode') === 'beatmapset') {
-            return ujs_redirect(route('beatmapsets.index', ['q' => request('query')]));
+        $currentUser = Auth::user();
+        $allSearch = new AllSearch(Request::all(), ['user' => $currentUser]);
+
+        if ($allSearch->getMode() === 'beatmapset') {
+            return ujs_redirect(route('beatmapsets.index', ['q' => $allSearch->getRawQuery()]));
         }
 
-        $allSearch = new AllSearch(request(), ['user' => Auth::user()]);
         $isSearchPage = true;
 
         if (is_api_request()) {
             return response()->json($allSearch->toJson());
         }
 
-        $fields = Auth::user()?->isModerator() ?? false ? [] : ['includeDeleted' => null];
+        $fields = $currentUser?->isModerator() ?? false ? [] : ['includeDeleted' => null];
 
         return ext_view('home.search', compact('allSearch', 'fields', 'isSearchPage'));
     }

app/Libraries/Search/ForumSearchRequestParams.php

@@ -14,11 +14,11 @@ public function __construct(array $request, ?User $user)
     {
         parent::__construct();
 
-        $this->queryString = presence(trim($request['query'] ?? null));
+        $this->queryString = presence(trim(get_string($request['query'] ?? null) ?? ''));
         $this->page = get_int($request['page'] ?? null);
         $this->from = $this->pageAsFrom($this->page);
         $this->includeSubforums = get_bool($request['forum_children'] ?? false);
-        $this->username = presence(trim($request['username'] ?? null));
+        $this->username = presence(trim(get_string($request['username'] ?? null) ?? ''));
         $this->forumId = get_int($request['forum_id'] ?? null);
         $this->topicId = get_int($request['topic_id'] ?? null);
         $this->parseSort(get_string($request['sort'] ?? null));

app/Libraries/Search/MultiSearch.php

@@ -5,8 +5,6 @@
 
 namespace App\Libraries\Search;
 
-use Illuminate\Http\Request;
-
 class MultiSearch
 {
     const MODES = [
@@ -36,24 +34,36 @@ class MultiSearch
     private $options;
     private $query;
     private $searches;
-    private array $request;
 
-    public function __construct(Request $request, array $options = [])
+    public function __construct(private array $request, array $options = [])
     {
-        $this->request = $request->all();
-        $this->query = trim(get_string($this->request['query'] ?? null) ?? '');
+        if (isset($this->request['mode'])) {
+            $this->request['mode'] = presence(get_string($this->request['mode']));
+        }
+        if (isset($this->request['query'])) {
+            $this->request['query'] = get_string($this->request['query']);
+        }
+        if (isset($this->request['username'])) {
+            $this->request['username'] = presence(get_string($this->request['username']));
+        }
+        $this->query = trim($this->request['query'] ?? '');
         $this->options = $options;
     }
 
     public function getMode()
     {
-        return presence($this->request['mode'] ?? null) ?? 'all';
+        return $this->request['mode'] ?? 'all';
+    }
+
+    public function getRawQuery(): ?string
+    {
+        return $this->request['query'] ?? null;
     }
 
     public function hasQuery()
     {
         return present($this->query)
-            || ($this->getMode() === 'forum_post' && present(get_string($this->request['username'] ?? null)));
+            || ($this->getMode() === 'forum_post' && isset($this->request['username']));
     }
 
     public function searches()

app/Libraries/Search/UserSearchRequestParams.php

@@ -13,7 +13,7 @@ public function __construct(array $request)
     {
         parent::__construct();
 
-        $this->queryString = presence(trim($request['query'] ?? null));
+        $this->queryString = presence(trim(get_string($request['query'] ?? null) ?? ''));
         $this->page = get_int($request['page'] ?? null);
         $this->from = $this->pageAsFrom($this->page);
         $this->recentOnly = get_bool($request['recent_only'] ?? null);

app/Libraries/Search/WikiSearchRequestParams.php

@@ -11,8 +11,8 @@ public function __construct(array $request)
     {
         parent::__construct();
 
-        $this->queryString = trim($request['query'] ?? null);
-        $this->locale = $request['locale'] ?? null;
+        $this->queryString = trim(get_string($request['query'] ?? null) ?? '');
+        $this->locale = get_string($request['locale'] ?? null);
         $this->page = get_int($request['page'] ?? null);
         $this->from = $this->pageAsFrom($this->page);
     }

resources/views/home/_search_page_tabs.blade.php

@@ -12,7 +12,7 @@
                 }
             @endphp
             <a
-                href="{{ route('search', ['mode' => $mode, 'query' => request('query')]) }}"
+                href="{{ route('search', ['mode' => $mode, 'query' => $allSearch->getRawQuery()]) }}"
                 class="{{ $cssClasses }}"
             >
                 <span class="fake-bold" data-content="{{ osu_trans("home.search.mode.{$mode}") }}">

resources/views/home/_search_results.blade.php

@@ -25,7 +25,7 @@
 
             <a
                 class="search-result__more-button {{ $showMore ? '' : 'search-result__more-button--hidden' }}"
-                href="{{ route('search', ['mode' => $mode, 'query' => request('query')]) }}"
+                href="{{ route('search', ['mode' => $mode, 'query' => $allSearch->getRawQuery()]) }}"
             >
                 <span class="fas fa-angle-right"></span>
             </a>
@@ -34,12 +34,12 @@ class="search-result__more-button {{ $showMore ? '' : 'search-result__more-butto
         @if ($showMore)
             <a
                 class="search-result__row search-result__row--more"
-                href="{{ route('search', ['mode' => $mode, 'query' => request('query')]) }}"
+                href="{{ route('search', ['mode' => $mode, 'query' => $allSearch->getRawQuery()]) }}"
             >
                 {{ osu_trans("home.search.{$mode}.more_simple") }}
             </a>
         @else
-            @if (request('mode') === 'user' && $search->overLimit())
+            @if ($allSearch->getMode() === 'user' && $search->overLimit())
                 <div class="search-result__row search-result__row--notice">
                     {{ osu_trans("home.search.user.more_hidden", ['max' => config("osu.search.max.user")]) }}
                 </div>

resources/views/home/search.blade.php

@@ -18,20 +18,20 @@
         class="js-search osu-page"
         autocomplete="off"
     >
-        <input type="hidden" name="mode" value="{{ request('mode') }}">
+        <input type="hidden" name="mode" value="{{ $allSearch->getMode() }}">
 
         <div class="search-header js-search--header">
             <div class="search-header__box">
                 <input
                     autofocus
                     class="search-header__input js-search--input"
-                    data-search-current="{{ request('query') }}"
+                    data-search-current="{{ $allSearch->getRawQuery() }}"
                     data-turbolinks-permanent
                     id="search-input"
                     name="query"
                     placeholder="{{ osu_trans('home.search.placeholder') }}"
                     type="search"
-                    value="{{ request('query') }}"
+                    value="{{ $allSearch->getRawQuery() }}"
                 />
 
                 <button class="search-header__icon search-header__icon--normal">