From b78b096ae42a6567a13392fff6594475ec2ff56d Mon Sep 17 00:00:00 2001 From: Wolfgang Walther Date: Thu, 27 Oct 2022 11:30:01 +0200 Subject: [PATCH] fix: Stricter query string parsing - no empty fts lang Signed-off-by: Wolfgang Walther --- CHANGELOG.md | 2 +- src/PostgREST/ApiRequest/QueryParams.hs | 8 +++++++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 9b395c5b9..107e513f8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -29,7 +29,7 @@ This project adheres to [Semantic Versioning](http://semver.org/). - #2444, Removed `db-pool-timeout` option, because this was removed upstream in hasql-pool. - @robx - #2343, PATCH requests that don't affect any rows no longer return 404 - @wolfgangwalther - - #2537, Stricter parsing of query string. Instead of silently ignoring, the parser now throws on invalid syntax like json paths for embeddings, hints for regular columns, empty casts, etc. - @wolfgangwalther + - #2537, Stricter parsing of query string. Instead of silently ignoring, the parser now throws on invalid syntax like json paths for embeddings, hints for regular columns, empty casts or fts languages, etc. - @wolfgangwalther ### Deprecated diff --git a/src/PostgREST/ApiRequest/QueryParams.hs b/src/PostgREST/ApiRequest/QueryParams.hs index 82bb00eb0..acd1bb51f 100644 --- a/src/PostgREST/ApiRequest/QueryParams.hs +++ b/src/PostgREST/ApiRequest/QueryParams.hs @@ -518,6 +518,12 @@ pFieldSelect = lexeme $ try (void $ lookAhead (string ",")) <|> try eof +-- | +-- Parse operator expression used in horizontal filtering +-- +-- >>> P.parse (pOpExpr pSingleVal) "" "fts().value" +-- Left (line 1, column 7): +-- unknown single value operator fts() pOpExpr :: Parser SingleVal -> Parser OpExpr pOpExpr pSVal = try ( string "not" *> pDelimiter *> (OpExpr True <$> pOperation)) <|> OpExpr False <$> pOperation where @@ -541,7 +547,7 @@ pOpExpr pSVal = try ( string "not" *> pDelimiter *> (OpExpr True <$> pOperation) pFts = do opStr <- try (P.many (noneOf ".(")) op <- parseMaybe ("unknown fts operator " <> opStr) . ftsOperator $ toS opStr - lang <- optionMaybe $ try (between (char '(') (char ')') $ many pIdentifierChar) + lang <- optionMaybe $ try (between (char '(') (char ')') $ many1 pIdentifierChar) pDelimiter >> Fts op (toS <$> lang) <$> pSVal parseMaybe :: [Char] -> Maybe a -> Parser a