diff --git a/package-lock.json b/package-lock.json index 9e23756b..7c003297 100644 --- a/package-lock.json +++ b/package-lock.json @@ -2404,9 +2404,9 @@ "dev": true }, "handlebars": { - "version": "4.7.2", - "resolved": "https://registry.npmjs.org/handlebars/-/handlebars-4.7.2.tgz", - "integrity": "sha512-4PwqDL2laXtTWZghzzCtunQUTLbo31pcCJrd/B/9JP8XbhVzpS5ZXuKqlOzsd1rtcaLo4KqAn8nl8mkknS4MHw==", + "version": "4.5.3", + "resolved": "https://registry.npmjs.org/handlebars/-/handlebars-4.5.3.tgz", + "integrity": "sha512-3yPecJoJHK/4c6aZhSvxOyG4vJKDshV36VHp0iVCDVh7o9w2vwi3NSnL2MMPj3YdduqaBcu7cGbggJQM0br9xA==", "requires": { "neo-async": "^2.6.0", "optimist": "^0.6.1", @@ -2450,9 +2450,25 @@ "dev": true }, "highlight.js": { - "version": "9.18.0", - "resolved": "https://registry.npmjs.org/highlight.js/-/highlight.js-9.18.0.tgz", - "integrity": "sha512-A97kI1KAUzKoAiEoaGcf2O9YPS8nbDTCRFokaaeBhnqjQTvbAuAJrQMm21zw8s8xzaMtCQBtgbyGXLGxdxQyqQ==" + "version": "9.17.1", + "resolved": "https://registry.npmjs.org/highlight.js/-/highlight.js-9.17.1.tgz", + "integrity": "sha512-TA2/doAur5Ol8+iM3Ov7qy3jYcr/QiJ2eDTdRF4dfbjG7AaaB99J5G+zSl11ljbl6cIcahgPY6SKb3sC3EJ0fw==", + "requires": { + "handlebars": "^4.5.3" + }, + "dependencies": { + "handlebars": { + "version": "4.5.3", + "resolved": "https://registry.npmjs.org/handlebars/-/handlebars-4.5.3.tgz", + "integrity": "sha512-3yPecJoJHK/4c6aZhSvxOyG4vJKDshV36VHp0iVCDVh7o9w2vwi3NSnL2MMPj3YdduqaBcu7cGbggJQM0br9xA==", + "requires": { + "neo-async": "^2.6.0", + "optimist": "^0.6.1", + "source-map": "^0.6.1", + "uglify-js": "^3.1.4" + } + } + } }, "hosted-git-info": { "version": "2.7.1", @@ -4903,6 +4919,18 @@ "universalify": "^0.1.0" } }, + "handlebars": { + "version": "4.7.3", + "resolved": "https://registry.npmjs.org/handlebars/-/handlebars-4.7.3.tgz", + "integrity": "sha512-SRGwSYuNfx8DwHD/6InAPzD6RgeruWLT+B8e8a7gGs8FWgHzlExpTFMEq2IA6QpAfOClpKHy6+8IqTjeBCu6Kg==", + "dev": true, + "requires": { + "neo-async": "^2.6.0", + "optimist": "^0.6.1", + "source-map": "^0.6.1", + "uglify-js": "^3.1.4" + } + }, "typescript": { "version": "3.7.5", "resolved": "https://registry.npmjs.org/typescript/-/typescript-3.7.5.tgz", diff --git a/src/storage/elasticsearch/query.ts b/src/storage/elasticsearch/query.ts index b008acbe..7ea19af0 100644 --- a/src/storage/elasticsearch/query.ts +++ b/src/storage/elasticsearch/query.ts @@ -41,6 +41,20 @@ import { ESTypeFilter, } from './common'; +/** + * Escapes any reserved character that would otherwise not be accepted by Elasticsearch + * + * Elasticsearch as the following reserved characters: + * + - = && || > < ! ( ) { } [ ] ^ " ~ * ? : \ / + * It is possible to use all, with the exception of < and >, of them by escaping them with a \ + * https://www.elastic.co/guide/en/elasticsearch/reference/5.6/query-dsl-query-string-query.html + * + * @param str the string to escape the characters from + */ +function escapeESReservedCharacters(str: string): string { + return str.replace(/[+\-=!(){}\[\]^"~*?:\\/]|(&&)|(\|\|)/g, '\\$&'); +} + /** * Builds a boolean filter. Returns an elasticsearch boolean filter */ @@ -301,7 +315,7 @@ export function buildQuery( analyzer: 'search_german', default_field: 'name', minimum_should_match: '90%', - query: (typeof params.query !== 'string') ? '*' : params.query, + query: (typeof params.query !== 'string') ? '*' : escapeESReservedCharacters(params.query), }, }; } else if (elasticsearchConfig.query.queryType === 'query_string') { @@ -310,7 +324,7 @@ export function buildQuery( analyzer: 'search_german', default_field: 'name', minimum_should_match: elasticsearchConfig.query.minMatch, - query: (typeof params.query !== 'string') ? '*' : params.query, + query: (typeof params.query !== 'string') ? '*' : escapeESReservedCharacters(params.query), }, }; } else if (elasticsearchConfig.query.queryType === 'dis_max') { @@ -334,7 +348,7 @@ export function buildQuery( analyzer: 'search_german', default_field: 'name', minimum_should_match: elasticsearchConfig.query.fuzziness, - query: (typeof params.query !== 'string') ? '*' : params.query, + query: (typeof params.query !== 'string') ? '*' : escapeESReservedCharacters(params.query), }, }, ],