Item7834: Sanitation of search

TWiki:Main/PeterThoeny

Related/prerequisite to fix this is TWiki:Codev.NewModeSearchEncodingInENCODEandURLPARAM (Item7847)

-- TWiki:Main.PeterThoeny - 2018-07-14

Patch core code:

Index: lib/TWiki/Search.pm
===================================================================
--- lib/TWiki/Search.pm   (revision 30573)
+++ lib/TWiki/Search.pm   (working copy)
@@ -533,6 +533,7 @@
     my $output = '';
     my $tmpl   = '';
 
+    $searchString =~ s/$TWiki::percentSubstitute/%/go; # Item7847
     my $originalSearch = $searchString;
     my $spacedTopic;
 
Index: lib/TWiki.pm
===================================================================
--- lib/TWiki.pm   (revision 30573)
+++ lib/TWiki.pm   (working copy)
@@ -93,6 +93,7 @@
 # Other computed constants
 use vars qw(
       $TranslationToken
+      $percentSubstitute
       $twikiLibDir
       %regex
       %functionTags
@@ -120,6 +121,12 @@
 # See Codev.NationalCharTokenClash for more.
 $TranslationToken= "\0";
 
+# Hack to substitute a % into a non-printable character so that a
+# search string can be passed from URLPARAM to SEARCH without variable
+# expansion, e.g. for a literal search.
+# (TWiki:Codev.NewModeSearchEncodingInENCODEandURLPARAM & Item7847)
+$percentSubstitute = "\x1a";
+
 =pod
 
 ---++ StaticMethod getTWikiLibDir() -> $path
@@ -4675,9 +4682,14 @@
         # entity encode, encode also space, newline and linefeed
         return entityEncode( $text, " \n\r" );
     } elsif ( $type =~ /^quotes?$/i ) {
-        # escape quotes with backslash (Bugs:Item3383 fix)
+        # escape quotes with backslash (Item3383)
         $text =~ s/\"/\\"/go;
         return $text;
+    } elsif ( $type =~ /^search$/i ) {
+        # substitue % with \x1a (Item7847), also escape quotes with backslash
+        $text =~ s/\"/\\"/go;
+        $text =~ s/%/$percentSubstitute/go;
+        return $text;
     } elsif ($type =~ /^url$/i) {
         # legacy
         $text =~ s/\r*\n\r*/<br \/>/g;

Patch TWiki topics:

Index: data/TWiki/WebSearch.txt
===================================================================
--- data/TWiki/WebSearch.txt   (revision 30573)
+++ data/TWiki/WebSearch.txt   (working copy)
@@ -1,4 +1,4 @@
-%META:TOPICINFO{author="TWikiContributor" date="1431720932" format="1.1" version="$Rev$"}%
+%META:TOPICINFO{author="TWikiContributor" date="1531611774" format="1.1" version="$Rev$"}%
 %META:TOPICPARENT{name="WebHome"}%
 ---+ %MAKETEXT{"Search in [_1] Web" args="<nop>%BASEWEB%"}%
 
@@ -6,7 +6,7 @@
 
 %INCLUDE{"%SYSTEMWEB%.SearchResultsPagination" section="preamble"}%<nop>
 %SEARCH{ 
-"%URLPARAM{"search" encode="quote"}%" 
+"%URLPARAM{"search" encode="search"}%" 
 type="%URLPARAM{"type" encode="entity" default="%SEARCHDEFAULTTYPE%"}%" 
 scope="%URLPARAM{"scope" encode="entity"}%" 
 web="%URLPARAM{"web" encode="entity"}%" 
Index: data/TWiki/WebSearchAdvanced.txt
===================================================================
--- data/TWiki/WebSearchAdvanced.txt   (revision 30573)
+++ data/TWiki/WebSearchAdvanced.txt   (working copy)
@@ -1,4 +1,4 @@
-%META:TOPICINFO{author="TWikiContributor" date="1431652587" format="1.1" version="$Rev$"}%
+%META:TOPICINFO{author="TWikiContributor" date="1531611770" format="1.1" version="$Rev$"}%
 %META:TOPICPARENT{name="WebSearch"}%
 ---+ %MAKETEXT{"Advanced Search"}%
 
@@ -6,7 +6,7 @@
 
 %INCLUDE{"%SYSTEMWEB%.SearchResultsPagination" section="preamble"}%<nop>
 %SEARCH{
- "%URLPARAM{"search" encode="quote"}%"
+ "%URLPARAM{"search" encode="search"}%"
  type="%IF{" '%URLPARAM{"regex" encode="entity"}%' = 'on' or '%URLPARAM{"type" encode="entity"}%' = 'regex'" the
n="regex" else="%SEARCHDEFAULTTYPE%"}%"
  scope="%URLPARAM{"scope" encode="entity"}%"
  web="%URLPARAM{"web" encode="entity"}%"

-- TWiki:Main.PeterThoeny - 2018-07-15