fix(api): refactors the SQL LIKE pattern escaping logic to use a centralized utility function, ensuring consistent and secure handling of special characters across all database queries.#25
fix(api): refactors the SQL LIKE pattern escaping logic to use a centralized utility function, ensuring consistent and secure handling of special characters across all database queries.#25
Conversation
…ralized utility function, ensuring consistent and secure handling of special characters across all database queries. Signed-off-by: NeatGuyCoding <15627489+NeatGuyCoding@users.noreply.github.com>
…logic Signed-off-by: NeatGuyCoding <15627489+NeatGuyCoding@users.noreply.github.com>
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 3 potential issues.
Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.
| SELECT TOP {top_k} id, text, meta | ||
| FROM {self.schema}.{self.table_name} | ||
| WHERE text LIKE ? | ||
| WHERE text LIKE ? ESCAPE '|' |
There was a problem hiding this comment.
Mismatched ESCAPE character in IRIS vector search
High Severity
The escape_like_pattern function escapes special characters using backslash (\) as the escape character, but the SQL ESCAPE '|' clause tells the database to use pipe (|) instead. This mismatch means escaped characters like \% won't be recognized as literals - the database expects |%. The LIKE pattern search will fail to correctly match special characters.
| case "not contains": | ||
| filters.append(json_field.notlike(f"%{value}%")) | ||
| escaped_value = escape_like_pattern(str(value)) | ||
| filters.append(json_field.notlike(f"%{escaped_value}%")) |
There was a problem hiding this comment.
Missing escape parameter in "not contains" filter
Medium Severity
The "not contains" case calls escape_like_pattern() but omits the escape="\\" parameter when calling notlike(). All other filter conditions ("contains", "start with", "end with") correctly include this parameter. Without it, the database won't interpret the backslash-escaped characters, so special characters in filter values will still act as wildcards.
| from libs.helper import escape_like_pattern | ||
|
|
||
| escaped_query = escape_like_pattern(query).replace("'", "''") | ||
| filter_clauses.append(f"{Field.CONTENT_KEY} LIKE '%{escaped_query}%' ESCAPE '\\\\'") |
There was a problem hiding this comment.
ClickZetta ESCAPE clause uses wrong escape character
Medium Severity
The code sets cz.sql.string.literal.escape.mode = 'quote' which means backslashes in SQL string literals are literal characters. With this setting, ESCAPE '\\\\' becomes ESCAPE '\\' in SQL, specifying two backslashes as the escape character. However, escape_like_pattern escapes using a single backslash (e.g., 50% becomes 50\%), causing a mismatch that breaks the LIKE pattern escaping.
2 participants
Benchmark PR from qodo-benchmark#431
Note
Strengthens search/query safety and consistency by standardizing SQL LIKE escaping.
libs.helper.escape_like_patternutility to escape%,_, and\for safe LIKE/ILIKE usageESCAPEclauses%,_,\) and ensures literal matching without wildcard injection; minor test import adjustments to avoid circular dependenciesWritten by Cursor Bugbot for commit b00e6e8. Configure here.