From b74fd71d67d600b2acabfef34b6d9e05e9264463 Mon Sep 17 00:00:00 2001
From: dakkar <dakkar@thenautilus.net>
Date: Sun, 22 Oct 2023 13:35:11 +0100
Subject: [PATCH 1/2] nicer file type search
* the previous one could allow a SQL injection, since the
`opts.filetype` value came straight from the browser
* this more precise regex match will not produce spurious
matches (which were very unlikely, true, but still, let's be
precise) (`video/movingimages` would have matched `%image%`!)
---
packages/backend/src/core/SearchService.ts | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/packages/backend/src/core/SearchService.ts b/packages/backend/src/core/SearchService.ts
index 9dc53dafef..4fd1d72f22 100644
--- a/packages/backend/src/core/SearchService.ts
+++ b/packages/backend/src/core/SearchService.ts
@@ -220,7 +220,18 @@ export class SearchService {
}
if (opts.filetype) {
- query.andWhere(`note."attachedFileTypes"::varchar LIKE '%${opts.filetype}%'`);
+ // this is very ugly, but the "correct" solution would
+ // be `and exists (select 1 from
+ // unnest(note."attachedFileTypes") x(t) where t like
+ // :type)` and I can't find a way to get TypeORM to
+ // generate that; this hack works because `~*` is
+ // "regexp match, ignoring case" and the stringified
+ // version of an array of varchars (which is what
+ // `attachedFileTypes` is) looks like `{foo,bar}`, so
+ // we're looking for opts.filetype as the first half
+ // of a MIME type, either at start of the array (after
+ // the `{`) or later (after a `,`)
+ query.andWhere(`note."attachedFileTypes"::varchar ~* :type`, { type: `[{,]${opts.filetype}/` });
}
this.queryService.generateVisibilityQuery(query, me);
From 1dc5623713915c2bf3dae93a3473d80e93f96be8 Mon Sep 17 00:00:00 2001
From: dakkar <dakkar@thenautilus.net>
Date: Sun, 22 Oct 2023 13:43:19 +0100
Subject: [PATCH 2/2] use block comment
---
packages/backend/src/core/SearchService.ts | 22 +++++++++++-----------
1 file changed, 11 insertions(+), 11 deletions(-)
diff --git a/packages/backend/src/core/SearchService.ts b/packages/backend/src/core/SearchService.ts
index 4fd1d72f22..6103b0e0f6 100644
--- a/packages/backend/src/core/SearchService.ts
+++ b/packages/backend/src/core/SearchService.ts
@@ -220,17 +220,17 @@ export class SearchService {
}
if (opts.filetype) {
- // this is very ugly, but the "correct" solution would
- // be `and exists (select 1 from
- // unnest(note."attachedFileTypes") x(t) where t like
- // :type)` and I can't find a way to get TypeORM to
- // generate that; this hack works because `~*` is
- // "regexp match, ignoring case" and the stringified
- // version of an array of varchars (which is what
- // `attachedFileTypes` is) looks like `{foo,bar}`, so
- // we're looking for opts.filetype as the first half
- // of a MIME type, either at start of the array (after
- // the `{`) or later (after a `,`)
+ /* this is very ugly, but the "correct" solution would
+ be `and exists (select 1 from
+ unnest(note."attachedFileTypes") x(t) where t like
+ :type)` and I can't find a way to get TypeORM to
+ generate that; this hack works because `~*` is
+ "regexp match, ignoring case" and the stringified
+ version of an array of varchars (which is what
+ `attachedFileTypes` is) looks like `{foo,bar}`, so
+ we're looking for opts.filetype as the first half of
+ a MIME type, either at start of the array (after the
+ `{`) or later (after a `,`) */
query.andWhere(`note."attachedFileTypes"::varchar ~* :type`, { type: `[{,]${opts.filetype}/` });
}