Skip to content

Commit 5dfebf0

Browse files
committed
fix(highlight): don't highlight all words when querying .*
Assume good faith: a user wanted to highlight all words, this is not DOS hardening. Issue 40
1 parent 60c8247 commit 5dfebf0

2 files changed

Lines changed: 20 additions & 3 deletions

File tree

CorpusSearch.Test/HighlightingTest.cs

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -189,6 +189,19 @@ public void CountsAreUnchangedByHighlighting()
189189
Assert.That(result.Lines.Select(x => x.MatchesInLine), Is.EquivalentTo(new long?[] { 2, 1 }));
190190
}
191191

192+
[Test]
193+
public void WildcardOnlyQueriesBrowseInsteadOfHighlightingEveryToken(
194+
[Values("*", " * ", ".*", ",*", "*.", "**")] string query)
195+
{
196+
// '.*' normalizes to '*' and previously bypassed the browse short-circuit,
197+
// matching (and highlighting) every token of every line
198+
this.AddManxDoc(DOC, "Ta çhengey aym", "gyn veg");
199+
var result = SearchWork(query);
200+
Assert.That(result.Lines, Has.Count.EqualTo(2));
201+
Assert.That(result.TotalMatches, Is.Null, "browse results have no match count");
202+
Assert.That(result.Lines.Select(x => x.ManxHighlights), Is.All.Null);
203+
}
204+
192205
private ScanResult Scan(string query, ScanOptions options = null)
193206
{
194207
return new Searcher(luceneIndex, parser).Scan(query, options ?? ScanOptions.Default);

CorpusSearch/Dependencies/Searcher.cs

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,13 @@ public class Searcher(LuceneIndex luceneIndex, SearchParser parser)
1717

1818
internal SearchResult SearchWork(string ident, string query, SearchOptions options)
1919
{
20-
if (query.Trim() == "*")
20+
// HACK: use the ScanOptions as they're the same for now
21+
var scanOptionsHack = new ScanOptions { SearchType = options.Type };
22+
23+
// Detect '*' on the normalized*query to handle '.*'.
24+
// Intended for good faith use, not security hardening.
25+
var normalizedQuery = GetTerm(query, scanOptionsHack);
26+
if (normalizedQuery.Length > 0 && normalizedQuery.All(x => x == '*'))
2127
{
2228
return new SearchResult
2329
{
@@ -26,8 +32,6 @@ internal SearchResult SearchWork(string ident, string query, SearchOptions optio
2632
TotalMatches = null,
2733
};
2834
}
29-
// HACK: use the ScanOptions as they're the same for now
30-
var scanOptionsHack = new ScanOptions { SearchType = options.Type };
3135

3236
// parse the string into a Result<Expression>
3337
var parsed = parser.Parse(query);

0 commit comments

Comments
 (0)