sendnrw/misskey
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: Escape SQL LIKE (#9493)

Browse Source 
* SQL LIKE escape

* CHANGELOG
This commit is contained in:
MeiMei
2023-01-08 20:32:17 +09:00
committed by GitHub
parent 1d7e0293a8
commit 10e526ba56
10 changed files with 27 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
packages/backend/src/server/api/endpoints/notes/search.ts
View File

@@ -6,6 +6,7 @@ import { QueryService } from '@/core/QueryService.js';
import { NoteEntityService } from '@/core/entities/NoteEntityService.js';
import type { Config } from '@/config.js';
import { DI } from '@/di-symbols.js';
import { sqlLikeEscape } from '@/misc/sql-like-escape';
export const meta = {
tags: ['notes'],
@@ -70,7 +71,7 @@ export default class extends Endpoint<typeof meta, typeof paramDef> {
}
query
.andWhere('note.text ILIKE :q', { q: `%${ps.query}%` })
.andWhere('note.text ILIKE :q', { q: `%${ sqlLikeEscape(ps.query) }%` })
.innerJoinAndSelect('note.user', 'user')
.leftJoinAndSelect('user.avatar', 'avatar')
.leftJoinAndSelect('user.banner', 'banner')