[
https://issues.apache.org/jira/browse/SOLR-18345?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18104207#comment-18104207
]
David Smiley commented on SOLR-18345:
-------------------------------------
bq. SolrFilter#translateLike embeds a field:"quoted terms" clause into
\{!complexphrase v='...'\} for SQL LIKE queries with mixed wildcards+multiple
words. Any backslash in that embedded value (from escaped wildcard/literal
chars) gets mis-decoded server-side — so a LIKE query with an escaped %/_
alongside a wildcard can silently return wrong rows or throw a parse error via
the JDBC/SQL handler.
> ClientUtils.encodeLocalParamVal() can produces lossy/invalid encodings
> ----------------------------------------------------------------------
>
> Key: SOLR-18345
> URL: https://issues.apache.org/jira/browse/SOLR-18345
> Project: Solr
> Issue Type: Bug
> Reporter: David Smiley
> Assignee: David Smiley
> Priority: Major
>
> ClientUtils.encodeLocalParamVal(String) safely embeds an arbitrary literal
> value into a Solr local-params string (e.g. \{!key=<value>\}, for consumption
> by QueryParsing#parseLocalParams / StrParser. It had two related bugs:
> 1. It escaped an embedded single quote (') but not an embedded backslash (\).
> Since StrParser#getQuotedString treats '\' as the start of an escape
> sequence, an unescaped backslash in the value is misinterpreted on
> decode (e.g. a literal "\n" in the value becomes an actual newline).
> 2. It failed to quote a value whose first character is itself a quote
> character ('or "), even when no other quoting trigger (whitespace or '}')
> was present. QueryParsing#parseLocalParams treats a quote character
> immediately after '=' as the start of a quoted value, so such values were
> misparsed (e.g. "''" round-tripped to "").
> Both cause encoded values to not round-trip correctly, so callers building
> local-params strings from arbitrary field values/keys could produce
> corrupted or unparseable queries.
> Fix: escape backslashes in addition to single quotes, and force quoting
> whenever the value starts with a quote character.
> _(written by AI)_
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
