You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I noticed that we are encoding FTS queries in the GUI, and at some point we are even encoding them twice. This also means we are sending FTS-encoded queries as part of the request over the HTTP API. Even though this is all fine, we could consider deferring encoding FTS queries to the core.
The following reasons were given for encoding FTS queries on the GUI side:
To avoid sending invalid search queries to remote peers if a user typed an invalid query (like just a single "double quote" symbol)
To successfully handle the case of query injection in RemoteQueryCommunity when a malicious peer sends a query with a wrong syntax (for example, when a closing double quote is missed)
To be sure that the local search endpoint works in the same way as remote searches via RemoteQueryCommunity.
I think, however, that it is more clean to send the unencoded query over the HTTP API and invoke the to_fts_query before doing the search in the database, or just before sending out messages in the RemoteQueryCommunity. Doing it this way also shouldn't break compatibility with the RemoteQueryCommunity.
The text was updated successfully, but these errors were encountered:
I noticed that we are encoding FTS queries in the GUI, and at some point we are even encoding them twice. This also means we are sending FTS-encoded queries as part of the request over the HTTP API. Even though this is all fine, we could consider deferring encoding FTS queries to the core.
The following reasons were given for encoding FTS queries on the GUI side:
I think, however, that it is more clean to send the unencoded query over the HTTP API and invoke the
to_fts_query
before doing the search in the database, or just before sending out messages in theRemoteQueryCommunity
. Doing it this way also shouldn't break compatibility with theRemoteQueryCommunity
.The text was updated successfully, but these errors were encountered: