From b6969c6dd01c786744d34e45ff79c2a746292d09 Mon Sep 17 00:00:00 2001 From: rulingcom Date: Sat, 24 Oct 2026 13:22:42 +0800 Subject: [PATCH] Escape user input before building regexps --- app/controllers/admin/universal_tables_controller.rb | 2 +- app/controllers/universal_tables_controller.rb | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/app/controllers/admin/universal_tables_controller.rb b/app/controllers/admin/universal_tables_controller.rb index 0dd0b5d..6a85bd6 100755 --- a/app/controllers/admin/universal_tables_controller.rb +++ b/app/controllers/admin/universal_tables_controller.rb @@ -298,7 +298,7 @@ end keywords = params["q"] keywords = keywords.strip.nil? ? keywords : keywords.strip regexes = keywords.split(/\s+(?=(?:[^"]*"[^"]*")*[^"]*$)/) - regex = Regexp.union(regexes.map{|word| Regexp.new(".*"+word+".*", "i")}) + regex = Regexp.union(regexes.map{|word| Regexp.new(".*"+Regexp.escape(word)+".*", "i")}) column = table.table_columns.where(:type.in => ["text","editor"]) columns = [] diff --git a/app/controllers/universal_tables_controller.rb b/app/controllers/universal_tables_controller.rb index 802d051..63d795e 100755 --- a/app/controllers/universal_tables_controller.rb +++ b/app/controllers/universal_tables_controller.rb @@ -146,7 +146,7 @@ class UniversalTablesController < ApplicationController # regexes = v.split(/\s+(?=(?:[^"]*"[^"]*")*[^"]*$)/) # regex = Regexp.union(regexes.map{|word| Regexp.new(".*"+word+".*", "i")}) # end - regex = Regexp.new(".*"+v+".*", "i") + regex = Regexp.new(".*"+Regexp.escape(v.to_s)+".*", "i") case column.type when "text" columns = column.column_entries.any_of([{"text.en" => regex}, {"text.zh_tw" => regex}])