Problem/Motivation

Fulltext.php
Lines 134-139

  public function op_contains($fulltext_field) {
    $value = mb_strtolower($this->value[0]);
    $value = str_replace(' ', '%', $value);
    $placeholder = $this->placeholder();
    $this->query->addWhereExpression($this->options['group'], "$fulltext_field LIKE $placeholder", [$placeholder => '% ' . $value . '%']);
  }

The value is parameter-bound, so no SQL injection. But the sibling op_word() escapes with $this->connection->escapeLike(...) before adding wildcards, and op_contains() doesn't — so literal %/_ typed by the user behave as SQL LIKE wildcards, broadening results beyond what the UI suggests.

Steps to reproduce

Proposed resolution

Call escapeLike() first, then do the space-to-% conversion.

Remaining tasks

User interface changes

API changes

Data model changes

Issue fork name-3586344

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

bluegeek9 created an issue. See original summary.

sanketprajapati made their first commit to this issue’s fork.

sanketprajapati opened merge request !84

sanketprajapati’s picture

sanketprajapati commented
Status: Active » Needs review

Hi @bluegeek9, I have created MR !84, Please review.
Before: https://prnt.sc/PFkCeaeEFjnt
After: https://prnt.sc/fgK5TCih3LJ8

bluegeek9 changed the visibility of the branch 8.x-1.x to hidden.

bluegeek9’s picture

bluegeek9 commented
Status: Needs review » Fixed
//www.flaticon.com/free-icons/thank-you Thank you for your contribution! Your continued support makes this project sustainable.
There are multiple ways to show appreciation for the work contributed to this project including:

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.