From: Timo Sirainen <tss@iki.fi>
Date: Fri, 27 Nov 2015 13:24:41 +0000 (+0200)
Subject: fts-solr: Fixed escaping query parameters.
X-Git-Tag: 2.2.20.rc1~24
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ebcb8cc4fe8862e364f03dcbc05e3db8aac98230;p=thirdparty%2Fdovecot%2Fcore.git

fts-solr: Fixed escaping query parameters.
Solr documentation says that "quoted string" would already work without
escaping, but that doesn't seem to be true (we were also missing the \"
escaping there). So we'll now escape all the special characters without
quotes around it, which seems to work. Also added '/' to list of special
characters, which is used by Solr 4.0.
---

diff --git a/src/plugins/fts-solr/fts-backend-solr-old.c b/src/plugins/fts-solr/fts-backend-solr-old.c
index dbaf062538..68f957c4ab 100644
--- a/src/plugins/fts-solr/fts-backend-solr-old.c
+++ b/src/plugins/fts-solr/fts-backend-solr-old.c
@@ -42,6 +42,8 @@ struct solr_fts_backend_update_context {
 	bool documents_added;
 };
 
+static const char *solr_escape_chars = "+-&|!(){}[]^\"~*?:\\/ ";
+
 static bool is_valid_xml_char(unichar_t chr)
 {
 	/* Valid characters in XML:
@@ -139,18 +141,28 @@ static const char *solr_escape_id_str(const char *str)
 	return str_c(tmp);
 }
 
+static const char *solr_escape(const char *str)
+{
+	string_t *ret;
+	unsigned int i;
+
+	ret = t_str_new(strlen(str) + 16);
+	for (i = 0; str[i] != '\0'; i++) {
+		if (strchr(solr_escape_chars, str[i]) != NULL)
+			str_append_c(ret, '\\');
+		str_append_c(ret, str[i]);
+	}
+	return str_c(ret);
+}
+
 static void solr_quote(string_t *dest, const char *str)
 {
-	str_append_c(dest, '"');
-	str_append(dest, str_escape(str));
-	str_append_c(dest, '"');
+	str_append(dest, solr_escape(str));
 }
 
 static void solr_quote_http(string_t *dest, const char *str)
 {
-	str_append(dest, "%22");
-	http_url_escape_param(dest, str);
-	str_append(dest, "%22");
+	http_url_escape_param(dest, solr_escape(str));
 }
 
 static void fts_solr_set_default_ns(struct solr_fts_backend *backend)
diff --git a/src/plugins/fts-solr/fts-backend-solr.c b/src/plugins/fts-solr/fts-backend-solr.c
index eaaaf5186b..9b53f4e3f6 100644
--- a/src/plugins/fts-solr/fts-backend-solr.c
+++ b/src/plugins/fts-solr/fts-backend-solr.c
@@ -63,6 +63,8 @@ struct solr_fts_backend_update_context {
 	unsigned int truncate_header:1;
 };
 
+static const char *solr_escape_chars = "+-&|!(){}[]^\"~*?:\\/ ";
+
 static bool is_valid_xml_char(unichar_t chr)
 {
 	/* Valid characters in XML:
@@ -143,11 +145,23 @@ static void xml_encode(string_t *dest, const char *str)
 	xml_encode_data(dest, (const unsigned char *)str, strlen(str));
 }
 
+static const char *solr_escape(const char *str)
+{
+	string_t *ret;
+	unsigned int i;
+
+	ret = t_str_new(strlen(str) + 16);
+	for (i = 0; str[i] != '\0'; i++) {
+		if (strchr(solr_escape_chars, str[i]) != NULL)
+			str_append_c(ret, '\\');
+		str_append_c(ret, str[i]);
+	}
+	return str_c(ret);
+}
+
 static void solr_quote_http(string_t *dest, const char *str)
 {
-	str_append(dest, "%22");
-	http_url_escape_param(dest, str);
-	str_append(dest, "%22");
+	http_url_escape_param(dest, solr_escape(str));
 }
 
 static struct fts_backend *fts_backend_solr_alloc(void)
@@ -623,8 +637,6 @@ static int fts_backend_solr_optimize(struct fts_backend *backend ATTR_UNUSED)
 
 static bool solr_need_escaping(const char *str)
 {
-	const char *solr_escape_chars = "+-&|!(){}[]^\"~*?:\\ ";
-
 	for (; *str != '\0'; str++) {
 		if (strchr(solr_escape_chars, *str) != NULL)
 			return TRUE;
@@ -640,7 +652,7 @@ static void solr_add_str_arg(string_t *str, struct mail_search_arg *arg)
 	if (!arg->fuzzy || solr_need_escaping(arg->value.str))
 		solr_quote_http(str, arg->value.str);
 	else {
-		str_append(str, arg->value.str);
+		http_url_escape_param(str, arg->value.str);
 		str_append_c(str, '~');
 	}
 }