@recaptime-dev's working patches + fork for Phorge, a community fork of Phabricator. (Upstream dev and stable branches are at upstream/main and upstream/stable respectively.)
hq.recaptime.dev/wiki/Phorge
phorge
phabricator
Prevent typeahead sources from querying against empty tokens
Summary:
Certain unusual queries, like `[-]`, could tokenize into a list which included the empty string.
This would then convert into a query for `... LIKE "%"` which just joins the entire table.
Instead: tokenize smarter; never return the empty token; add some test cases.
Test Plan: Ran unit tests. Queried for `[[blah blah]]`, saw a reasonable query come out the other end.
Reviewers: chad
Reviewed By: chad
Subscribers: 20after4
Differential Revision: https://secure.phabricator.com/D16888
+51
-2
+39
PhabricatorTypeaheadDatasourceTestCase.php
+39
PhabricatorTypeaheadDatasourceTestCase.php
···
1
+
<?php
2
+
3
+
final class PhabricatorTypeaheadDatasourceTestCase
4
+
extends PhabricatorTestCase {
5
+
6
+
public function testTypeaheadTokenization() {
7
+
$this->assertTokenization(
8
+
'The quick brown fox',
9
+
array('the', 'quick', 'brown', 'fox'));
10
+
11
+
$this->assertTokenization(
12
+
'Quack quack QUACK',
13
+
array('quack'));
14
+
15
+
$this->assertTokenization(
16
+
'',
17
+
array());
18
+
19
+
$this->assertTokenization(
20
+
' [ - ] ',
21
+
array());
22
+
23
+
$this->assertTokenization(
24
+
'jury-rigged',
25
+
array('jury', 'rigged'));
26
+
27
+
$this->assertTokenization(
28
+
'[[ brackets ]] [-] ]-[ tie-fighters',
29
+
array('brackets', 'tie', 'fighters'));
30
+
}
31
+
32
+
private function assertTokenization($input, $expect) {
33
+
$this->assertEqual(
34
+
$expect,
35
+
PhabricatorTypeaheadDatasource::tokenizeString($input),
36
+
pht('Tokenization of "%s"', $input));
37
+
}
38
+
39
+
}
+12
-2
src/applications/typeahead/datasource/PhabricatorTypeaheadDatasource.php
+12
-2
src/applications/typeahead/datasource/PhabricatorTypeaheadDatasource.php
···
141
141
return array();
142
142
}
143
143
144
-
$tokens = preg_split('/\s+|[-\[\]]/u', $string);
145
-
return array_unique($tokens);
144
+
$tokens = preg_split('/[\s\[\]-]+/u', $string);
145
+
$tokens = array_unique($tokens);
146
+
147
+
// Make sure we don't return the empty token, as this will boil down to a
148
+
// JOIN against every token.
149
+
foreach ($tokens as $key => $value) {
150
+
if (!strlen($value)) {
151
+
unset($tokens[$key]);
152
+
}
153
+
}
154
+
155
+
return array_values($tokens);
146
156
}
147
157
148
158
public function getTokens() {