David Smiley created SOLR-18345:
-----------------------------------
Summary: ClientUtils.encodeLocalParamVal() can produces
lossy/invalid encodings
Key: SOLR-18345
URL: https://issues.apache.org/jira/browse/SOLR-18345
Project: Solr
Issue Type: Bug
Reporter: David Smiley
Assignee: David Smiley
ClientUtils.encodeLocalParamVal(String) safely embeds an arbitrary literal
value into a Solr local-params string (e.g. {!key=<value>}), for consumption
by QueryParsing#parseLocalParams / StrParser. It had two related bugs:
1. It escaped an embedded single quote (') but not an embedded backslash (\).
Since StrParser#getQuotedString treats '\' as the start of an escape
sequence, an unescaped backslash in the value is misinterpreted on
decode (e.g. a literal "\n" in the value becomes an actual newline).
2. It failed to quote a value whose first character is itself a quote
character ('or "), even when no other quoting trigger (whitespace or '}')
was present. QueryParsing#parseLocalParams treats a quote character
immediately after '=' as the start of a quoted value, so such values were
misparsed (e.g. "''" round-tripped to "").
Both cause encoded values to not round-trip correctly, so callers building
local-params strings from arbitrary field values/keys could produce
corrupted or unparseable queries.
Fix: escape backslashes in addition to single quotes, and force quoting
whenever the value starts with a quote character.
_(written by AI)_
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
