escape parantheses in query

plone · Oct 25, 2024 · 2f89198 · 2f89198
1 parent dcdb41b
commit 2f89198
Showing 1 changed file with 10 additions and 0 deletions.
diff --git a/src/plone/restapi/search/handler.py b/src/plone/restapi/search/handler.py
@@ -75,6 +75,10 @@ def _constrain_query_by_path(self, query):
             path = "/".join(self.context.getPhysicalPath())
             query["path"]["query"] = path
 
+    def quote_chars(self, query):
+        # Escape parentheses by adding backslashes before them
+        return query.replace('(', '').replace(')', '').strip()
+
     def search(self, query=None):
         if query is None:
             query = {}
@@ -93,6 +97,12 @@ def search(self, query=None):
         if use_site_search_settings:
             query = self.filter_query(query)
 
+        if "SearchableText" in query:
+            # Sanitize SearchableText by removing parentheses
+            query["SearchableText"] = self.quote_chars(query["SearchableText"])
+            if not query["SearchableText"] or query["SearchableText"] == "*":
+                return []
+
         self._constrain_query_by_path(query)
         query = self._parse_query(query)