CSW GetRecords doesn't escape query values when creating the Elastics…

…earch query / Escape Elasticsearch special chars in IS LIKE literal queries
geonetwork · Jan 5, 2024 · 6c18b14 · 6c18b14
1 parent 8e0bad2
commit 6c18b14
Show file tree

Hide file tree

Showing 2 changed files with 83 additions and 1 deletion.
diff --git a/csw-server/src/main/java/org/fao/geonet/kernel/csw/services/getrecords/es/CswFilter2Es.java b/csw-server/src/main/java/org/fao/geonet/kernel/csw/services/getrecords/es/CswFilter2Es.java
@@ -181,7 +181,7 @@ protected static String escapeLikeLiteral(String text) {
     }
 
     protected static String convertLikePattern(PropertyIsLike filter) {
-        String result = StringEscapeUtils.escapeJson(filter.getLiteral());
+        String result = filter.getLiteral();
         if (!filter.getWildCard().equals("*")) {
             final String wildcardRe =
                 StringUtils.isNotEmpty(filter.getEscape())
@@ -196,6 +196,8 @@ protected static String convertLikePattern(PropertyIsLike filter) {
                     : filter.getSingleChar();
             result = result.replaceAll(singleCharRe, "?");
         }
+
+        result = StringEscapeUtils.escapeJson(escapeLikeLiteral(result));
         return result;
     }
 

diff --git a/...rver/src/test/java/org/fao/geonet/kernel/csw/services/getrecords/es/CswFilter2EsTest.java b/...rver/src/test/java/org/fao/geonet/kernel/csw/services/getrecords/es/CswFilter2EsTest.java
@@ -157,6 +157,86 @@ void testPropertyIsEqualTo() throws IOException {
         assertFilterEquals(expected, input);
     }
 
+    @Test
+    void testPropertyIsEqualToSpecialChars() throws IOException {
+        final String input =
+            "<Filter xmlns=\"http://www.opengis.net/ogc\">\n" //
+                + "    <PropertyIsEqualTo>\n" //
+                + "          <PropertyName>OnlineResourceType</PropertyName>\n" //
+                + "          <Literal>OGC:WMS</Literal>\n" //
+                + "    </PropertyIsEqualTo>\n" //
+                + "      </Filter>" //
+                + "";
+
+        // EXPECTED:
+        final ObjectNode expected = EsJsonHelper.boolbdr(). //
+            must(array(queryStringPart("OnlineResourceType", "OGC\\:WMS"))). //
+            filter(queryStringPart()). //
+            bld();
+
+        assertFilterEquals(expected, input);
+    }
+
+    @Test
+    void testPropertyIsLike() throws IOException {
+
+        final String input =
+            "<Filter xmlns=\"http://www.opengis.net/ogc\">\n" //
+                + "    <PropertyIsLike wildCard=\"%\" singleChar=\"_\" escapeChar=\"\\\">\n" //
+                + "          <PropertyName>AnyText</PropertyName>\n" //
+                + "          <Literal>s\\_rvice\\%</Literal>\n" //
+                + "    </PropertyIsLike>\n" //
+                + "      </Filter>" //
+                + "";
+
+        // EXPECTED:
+        final ObjectNode expected = EsJsonHelper.boolbdr(). //
+            must(array(queryStringPart("AnyText", "s?rvice*"))). //
+            filter(queryStringPart()). //
+            bld();
+
+        assertFilterEquals(expected, input);
+    }
+
+    @Test
+    void testPropertyIsLikeSpecialChars() throws IOException {
+
+        final String input =
+            "<Filter xmlns=\"http://www.opengis.net/ogc\">\n" //
+                + "    <PropertyIsLike wildCard=\"%\" singleChar=\"_\" escapeChar=\"\\\">\n" //
+                + "          <PropertyName>AnyText</PropertyName>\n" //
+                + "          <Literal>\"service\"</Literal>\n" //
+                + "    </PropertyIsLike>\n" //
+                + "      </Filter>" //
+                + "";
+
+        // EXPECTED:
+        final ObjectNode expected = EsJsonHelper.boolbdr(). //
+            must(array(queryStringPart("AnyText", "\\\"service\\\""))). //
+            filter(queryStringPart()). //
+            bld();
+
+        assertFilterEquals(expected, input);
+
+
+        final String input2 =
+            "<Filter xmlns=\"http://www.opengis.net/ogc\">\n" //
+                + "    <PropertyIsLike wildCard=\"%\" singleChar=\"_\" escapeChar=\"\\\">\n" //
+                + "          <PropertyName>AnyText</PropertyName>\n" //
+                + "          <Literal>OGC:WMS\\%</Literal>\n" //
+                + "    </PropertyIsLike>\n" //
+                + "      </Filter>" //
+                + "";
+
+        // EXPECTED:
+        final ObjectNode expected2 = EsJsonHelper.boolbdr(). //
+            must(array(queryStringPart("AnyText", "OGC\\:WMS*"))). //
+            filter(queryStringPart()). //
+            bld();
+
+        assertFilterEquals(expected2, input2);
+    }
+
     @Test
     void testLogicalAnd() throws IOException {