unable to search &<--

[KUKHUA]

If you attempt to search "&<--", it redirects to an error page.
I am on version 1.940 using the docker image yacy/yacy_search_server:latest
See here:

yacy.log

[okybaca]

i get the same error message, when i try same search string.
one could smell even some security implications in case of unsantitized input.

[smokingwheels]

Try this patch/replacement if ok please let me know if you need any help.

QueryGoal.java

`// extract token safely
String string = "";

if (p > 0) {
if (stop == space) {
string = s.substring(0, p);
} else if (p > 1) {
string = s.substring(0, p - 1); // exclude closing quote
}
}

// advance cursor
s = (p < s.length()) ? s.substring(p) : "";

// normalize
string = string.trim();
if (string.length() == 0) continue;

// store token
if (inc) {
if (!include_string.contains(string)) include_string.add(string);
} else {
if (!exclude_string.contains(string)) exclude_string.add(string);
}
`