trailofbits / multiplier

Code auditing productivity multiplier.
Apache License 2.0
438 stars 27 forks source link

Symbol search doesn't enforce FTS5 grammar #338

Open pgoodman opened 1 year ago

pgoodman commented 1 year ago

We use the FTS5 module for symbol search: https://www.sqlite.org/fts5.html#full_text_query_syntax. It's possible that a search term, e.g. blah=, will trigger a syntax error due to the =.

pgoodman commented 10 months ago

Something like this might help...

static std::string FixedQuery(std::string query) {
  std::string out;

  auto in_string = false;
  auto needs_and = false;
  for (auto ch : query) {
    if (std::isalnum(ch)) {
      if (!in_string) {
        if (needs_and) {
          out.push_back(' ');
          out.push_back('A');
          out.push_back('N');
          out.push_back('D');
          out.push_back(' ');
          needs_and = false;
        }
        out.push_back('"');
        in_string = true;
      }
      out.push_back(ch);

    } else {
      if (in_string) {
        out.push_back('"');
        in_string = false;
      }
      needs_and = true;
    }
  }

  if (in_string) {
    out.push_back('"');
  }

  return out;
}