_search= queries now correctly escaped, fixes #651

Queries with reserved words or characters according to the SQLite
FTS5 query language could cause errors.

Queries are now escaped like so:

    dog cat => "dog" "cat"
This commit is contained in:
Simon Willison 2019-12-29 18:48:13 +00:00
commit 3c861f363d
6 changed files with 47 additions and 2 deletions

View file

@ -758,6 +758,20 @@ def format_bytes(bytes):
return "{:.1f} {}".format(current, unit)
_escape_fts_re = re.compile(r'\s+|(".*?")')
def escape_fts(query):
# If query has unbalanced ", add one at end
if query.count('"') % 2:
query += '"'
bits = _escape_fts_re.split(query)
bits = [b for b in bits if b and b != '""']
return " ".join(
'"{}"'.format(bit) if not bit.startswith('"') else bit for bit in bits
)
class RequestParameters(dict):
def get(self, name, default=None):
"Return first value in the list, if available"