Searching with Brackets

Kylo

Excuse me if this has been asked before but what's happening when you search with brackets? e.g. [abc]

datitisev

Kylo The results are the same with [abc] as if you typed abc, but the highlighting code uses a Regular Expression to bold what you searched in the results, which means it treats [abc] as the characters a, b and c individually.

Hopefully that makes sense.

Kylo

datitisev what a dumb question it was, i wasn't aware of we could use regex as search input. But i think i broke it with (?<=hello)(.*)(?=flarum) or is it just .. slow?

datitisev

Kylo Sorry, I didn't make myself clear. You can't use regex as search input. The function that highlights the matching text in the search results uses regex to do so, so that's why the weird behavior occurred.

Not sure what's going on with your search query though 🤔.

Kylo

datitisev sorry i missed that part 😅

clarkwinkelmann it was a random regex from my archive, i also tested different ones like:

\b(?:(?:2(?:[0-4][0-9]|5[0-5])|[0-1]?[0-9]?[0-9])\.){3}(?:(?:2([0-4][0-9]|5[0-5])|[0-1]?[0-9]?[0-9]))\b
("|')((?:\\\1|(?:(?!\1).))*)\1
^\s*(?:\+?(\d{1,3}))?([-. (]*(\d{3})[-. )]*)?((\d{3})[-. ]*(\d{2,4})(?:[-.x ]*(\d+))?)\s*$
\b[\w\.-]+@[\w\.-]+\.\w{2,4}\b

they all returns https://discuss.flarum.org/d/17745-flarum-0-1-0-beta-8-released and sometimes https://discuss.flarum.org/d/20642-upgrade-form-beta-7-to-beta-9

clarkwinkelmann

~~I believe~~ I'm certain the issue is with our highlight() function in javascript. The PHP search doesn't support regex, but the highlighting is then performed client-side and that's where regex injection is possible.

It seems like we're not escaping anything at all, so basically anything you type is executed as a regex on the discussion title and post content client-side 🙊