[
https://issues.apache.org/jira/browse/SOLR-18345?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18107204#comment-18107204
]
Gus Heck commented on SOLR-18345:
---------------------------------
I'm sorry if my comments were unclear. Let me try again.
I'm trying to wrap my head around how this interacts with things like the
standard query parser...
{code:java}
| <#_ESCAPED_CHAR: "\\" ~[] > // every character that follows a backslash
is considered as an escaped character
....
| <#_QUOTED_CHAR: ( ~[ "\"", "\\" ] | <_ESCAPED_CHAR> ) >
| <#_SQUOTED_CHAR: ( ~[ "'", "\\" ] | <_ESCAPED_CHAR> ) >
....
| <QUOTED: "\"" (<_QUOTED_CHAR>)* "\"">
....
| <LPARAMS: ("{!" ( (<_WHITESPACE>)* (~["=","}"])+ ( "=" (<QUOTED> | ("'"
(<_SQUOTED_CHAR>)* "'") | (~[" ","}"])+ )? )? )* "}")+ (~[")","
","\t","\n","{","^"])* >
{code}
A whole lot of squinting at QueryParser.jj seems to support my recollection
that some of this is already handled in the standard query parser. Thus I think
any localparam case would wind up as fundamentally different from a
non-localparam case....
However, after digging for a while, I realized that even that even that case
tracks back to parseLocalParams()... so maybe we really do only have one notion
of how to parse LocalParams... My fundamental worry was that there would be
more than parsing routine to satisfy here. Also initially facets made me think
of JSON oriented stuff, so I wondered if this was going to interact with json
parsing, but I guess that you are just dealing with url parameter facet
parsing. I think I may have talked myself out of my worries here ;)
> ClientUtils.encodeLocalParamVal() can produces lossy/invalid encodings
> ----------------------------------------------------------------------
>
> Key: SOLR-18345
> URL: https://issues.apache.org/jira/browse/SOLR-18345
> Project: Solr
> Issue Type: Bug
> Reporter: David Smiley
> Assignee: David Smiley
> Priority: Major
> Labels: pull-request-available
> Fix For: 10.1, 9.11
>
> Time Spent: 0.5h
> Remaining Estimate: 0h
>
> ClientUtils.encodeLocalParamVal(String) safely embeds an arbitrary literal
> value into a Solr local-params string (e.g. \{!key=<value>\}, for consumption
> by QueryParsing#parseLocalParams / StrParser. It had two related bugs:
> 1. It escaped an embedded single quote (') but not an embedded backslash (\).
> Since StrParser#getQuotedString treats '\' as the start of an escape
> sequence, an unescaped backslash in the value is misinterpreted on
> decode (e.g. a literal "\n" in the value becomes an actual newline).
> 2. It failed to quote a value whose first character is itself a quote
> character ('or "), even when no other quoting trigger (whitespace or '}')
> was present. QueryParsing#parseLocalParams treats a quote character
> immediately after '=' as the start of a quoted value, so such values were
> misparsed (e.g. "''" round-tripped to "").
> Both cause encoded values to not round-trip correctly, so callers building
> local-params strings from arbitrary field values/keys could produce
> corrupted or unparseable queries.
> Fix: escape backslashes in addition to single quotes, and force quoting
> whenever the value starts with a quote character.
> _(written by AI)_
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
