From 6c18b14ee366f8df47b58d2c7605280a9111e7ff Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jose=20Garc=C3=ADa?= <josegar74@gmail.com>
Date: Fri, 5 Jan 2024 10:53:08 +0100
Subject: [PATCH] CSW GetRecords doesn't escape query values when creating the
 Elasticsearch query / Escape Elasticsearch special chars in IS LIKE literal
 queries

---
 .../services/getrecords/es/CswFilter2Es.java  |  4 +-
 .../getrecords/es/CswFilter2EsTest.java       | 80 +++++++++++++++++++
 2 files changed, 83 insertions(+), 1 deletion(-)

diff --git a/csw-server/src/main/java/org/fao/geonet/kernel/csw/services/getrecords/es/CswFilter2Es.java b/csw-server/src/main/java/org/fao/geonet/kernel/csw/services/getrecords/es/CswFilter2Es.java
index 6c0ecf502f9..bc888e541e8 100644
--- a/csw-server/src/main/java/org/fao/geonet/kernel/csw/services/getrecords/es/CswFilter2Es.java
+++ b/csw-server/src/main/java/org/fao/geonet/kernel/csw/services/getrecords/es/CswFilter2Es.java
@@ -181,7 +181,7 @@ protected static String escapeLikeLiteral(String text) {
     }
 
     protected static String convertLikePattern(PropertyIsLike filter) {
-        String result = StringEscapeUtils.escapeJson(filter.getLiteral());
+        String result = filter.getLiteral();
         if (!filter.getWildCard().equals("*")) {
             final String wildcardRe =
                 StringUtils.isNotEmpty(filter.getEscape())
@@ -196,6 +196,8 @@ protected static String convertLikePattern(PropertyIsLike filter) {
                     : filter.getSingleChar();
             result = result.replaceAll(singleCharRe, "?");
         }
+
+        result = StringEscapeUtils.escapeJson(escapeLikeLiteral(result));
         return result;
     }
 
diff --git a/csw-server/src/test/java/org/fao/geonet/kernel/csw/services/getrecords/es/CswFilter2EsTest.java b/csw-server/src/test/java/org/fao/geonet/kernel/csw/services/getrecords/es/CswFilter2EsTest.java
index 4b8a6024258..82ce4650af2 100644
--- a/csw-server/src/test/java/org/fao/geonet/kernel/csw/services/getrecords/es/CswFilter2EsTest.java
+++ b/csw-server/src/test/java/org/fao/geonet/kernel/csw/services/getrecords/es/CswFilter2EsTest.java
@@ -157,6 +157,86 @@ void testPropertyIsEqualTo() throws IOException {
         assertFilterEquals(expected, input);
     }
 
+    @Test
+    void testPropertyIsEqualToSpecialChars() throws IOException {
+        final String input =
+            "<Filter xmlns=\"http://www.opengis.net/ogc\">\n" //
+                + "    <PropertyIsEqualTo>\n" //
+                + "          <PropertyName>OnlineResourceType</PropertyName>\n" //
+                + "          <Literal>OGC:WMS</Literal>\n" //
+                + "    </PropertyIsEqualTo>\n" //
+                + "      </Filter>" //
+                + "";
+
+        // EXPECTED:
+        final ObjectNode expected = EsJsonHelper.boolbdr(). //
+            must(array(queryStringPart("OnlineResourceType", "OGC\\:WMS"))). //
+            filter(queryStringPart()). //
+            bld();
+
+        assertFilterEquals(expected, input);
+    }
+
+    @Test
+    void testPropertyIsLike() throws IOException {
+
+        final String input =
+            "<Filter xmlns=\"http://www.opengis.net/ogc\">\n" //
+                + "    <PropertyIsLike wildCard=\"%\" singleChar=\"_\" escapeChar=\"\\\">\n" //
+                + "          <PropertyName>AnyText</PropertyName>\n" //
+                + "          <Literal>s\\_rvice\\%</Literal>\n" //
+                + "    </PropertyIsLike>\n" //
+                + "      </Filter>" //
+                + "";
+
+        // EXPECTED:
+        final ObjectNode expected = EsJsonHelper.boolbdr(). //
+            must(array(queryStringPart("AnyText", "s?rvice*"))). //
+            filter(queryStringPart()). //
+            bld();
+
+        assertFilterEquals(expected, input);
+    }
+
+    @Test
+    void testPropertyIsLikeSpecialChars() throws IOException {
+
+        final String input =
+            "<Filter xmlns=\"http://www.opengis.net/ogc\">\n" //
+                + "    <PropertyIsLike wildCard=\"%\" singleChar=\"_\" escapeChar=\"\\\">\n" //
+                + "          <PropertyName>AnyText</PropertyName>\n" //
+                + "          <Literal>\"service\"</Literal>\n" //
+                + "    </PropertyIsLike>\n" //
+                + "      </Filter>" //
+                + "";
+
+        // EXPECTED:
+        final ObjectNode expected = EsJsonHelper.boolbdr(). //
+            must(array(queryStringPart("AnyText", "\\\"service\\\""))). //
+            filter(queryStringPart()). //
+            bld();
+
+        assertFilterEquals(expected, input);
+
+
+        final String input2 =
+            "<Filter xmlns=\"http://www.opengis.net/ogc\">\n" //
+                + "    <PropertyIsLike wildCard=\"%\" singleChar=\"_\" escapeChar=\"\\\">\n" //
+                + "          <PropertyName>AnyText</PropertyName>\n" //
+                + "          <Literal>OGC:WMS\\%</Literal>\n" //
+                + "    </PropertyIsLike>\n" //
+                + "      </Filter>" //
+                + "";
+
+        // EXPECTED:
+        final ObjectNode expected2 = EsJsonHelper.boolbdr(). //
+            must(array(queryStringPart("AnyText", "OGC\\:WMS*"))). //
+            filter(queryStringPart()). //
+            bld();
+
+        assertFilterEquals(expected2, input2);
+    }
+
     @Test
     void testLogicalAnd() throws IOException {