[jira] [Commented] (SOLR-18345) ClientUtils.encodeLocalParamVal() can produces lossy/invalid encodings

["David Smiley (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/SOLR-18345?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18104205#comment-18104205 ] 

David Smiley commented on SOLR-18345:
-------------------------------------

There are multiple callers of this within our codebase plus our users will likely call this (I raise my hand here as one).

Most serious effect is maybe this (faceting):

bq. Net effect for an end user: on a multi-shard collection, using a custom facet response key, e.g. \{!key=...}, that happens to contain a backslash or a leading quote character causes either quietly wrong facet counts or a sporadic 400 error, depending on exact shard-count distribution and how many shards need refinement for that particular query — very hard to reproduce without knowing the root cause, since it depends on the facet key text, not the underlying field/data.

And for users of the SQL module that include a LIKE clause, it seems to affect that too.

> ClientUtils.encodeLocalParamVal() can produces lossy/invalid encodings
> ----------------------------------------------------------------------
>
>                 Key: SOLR-18345
>                 URL: https://issues.apache.org/jira/browse/SOLR-18345
>             Project: Solr
>          Issue Type: Bug
>            Reporter: David Smiley
>            Assignee: David Smiley
>            Priority: Major
>
> ClientUtils.encodeLocalParamVal(String) safely embeds an arbitrary literal
> value into a Solr local-params string (e.g. \{!key=<value>\}, for consumption
> by QueryParsing#parseLocalParams / StrParser. It had two related bugs:
> 1. It escaped an embedded single quote (') but not an embedded backslash (\).
>    Since StrParser#getQuotedString treats '\' as the start of an escape
>    sequence, an unescaped backslash in the value is misinterpreted on
>    decode (e.g. a literal "\n" in the value becomes an actual newline).
> 2. It failed to quote a value whose first character is itself a quote
>    character ('or "), even when no other quoting trigger (whitespace or '}')
>    was present. QueryParsing#parseLocalParams treats a quote character
>    immediately after '=' as the start of a quoted value, so such values were
>    misparsed (e.g. "''" round-tripped to "").
> Both cause encoded values to not round-trip correctly, so callers building
> local-params strings from arbitrary field values/keys could produce
> corrupted or unparseable queries.
> Fix: escape backslashes in addition to single quotes, and force quoting
> whenever the value starts with a quote character.
> _(written by AI)_



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org