From e01177d3b26c182c80c5881864d49553dc6d88d9 Mon Sep 17 00:00:00 2001
From: Jens Kraemer <jk@jkraemer.net>
Date: Mon, 12 Apr 2021 11:24:23 +0800
Subject: [PATCH 2/5] use sanitize_sql_like on search tokens

- allows to actually search for terms containing '_' and '%'
- prevents possible DOS through queries containing many % or _
---
 .../lib/acts_as_searchable.rb                 |  2 +-
 test/unit/search_test.rb                      | 24 +++++++++++++++++++
 2 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/lib/plugins/acts_as_searchable/lib/acts_as_searchable.rb b/lib/plugins/acts_as_searchable/lib/acts_as_searchable.rb
index d8fd38447..871f39ef3 100644
--- a/lib/plugins/acts_as_searchable/lib/acts_as_searchable.rb
+++ b/lib/plugins/acts_as_searchable/lib/acts_as_searchable.rb
@@ -155,7 +155,7 @@ module Redmine
           def search_tokens_condition(columns, tokens, all_words)
             token_clauses = columns.map {|column| "(#{search_token_match_statement(column)})"}
             sql = (['(' + token_clauses.join(' OR ') + ')'] * tokens.size).join(all_words ? ' AND ' : ' OR ')
-            [sql, * (tokens.collect {|w| "%#{w}%"} * token_clauses.size).sort]
+            [sql, * (tokens.collect {|w| "%#{ActiveRecord::Base.sanitize_sql_like w}%"} * token_clauses.size).sort]
           end
           private :search_tokens_condition
 
diff --git a/test/unit/search_test.rb b/test/unit/search_test.rb
index 532dff299..ae83ed28a 100644
--- a/test/unit/search_test.rb
+++ b/test/unit/search_test.rb
@@ -150,6 +150,30 @@ class SearchTest < ActiveSupport::TestCase
     assert_include issue, r
   end
 
+  def test_search_should_not_allow_like_injection
+    issue = Issue.generate!(:subject => "asdf")
+
+    r = Issue.search_results('as_f')
+    assert_not_include issue, r
+
+    r = Issue.search_results('as%f')
+    assert_not_include issue, r
+  end
+
+  def test_search_should_find_underscore
+    issue = Issue.generate!(:subject => "as_f")
+
+    r = Issue.search_results('as_f')
+    assert_include issue, r
+  end
+
+  def test_search_should_find_percent_sign
+    issue = Issue.generate!(:subject => "as%f")
+
+    r = Issue.search_results('as%f')
+    assert_include issue, r
+  end
+
   def test_search_should_be_case_insensitive_with_accented_characters
     unless sqlite?
       issue1 = Issue.generate!(:subject => "Special chars: ÖÖ")
-- 
2.20.1