CSPACE-5828: Filter out advanced search queries consisting of only a single SQL wildc...

diff --git a/services/common/src/main/java/org/collectionspace/services/common/query/nuxeo/QueryManagerNuxeoImpl.java b/services/common/src/main/java/org/collectionspace/services/common/query/nuxeo/QueryManagerNuxeoImpl.java
index 20baf0c636b072d32c2f57f79f2054f46ac2844f..6ed215d30ce3a65691cf66dfdbe0bbd96b4e249b 100644 (file)
--- a/services/common/src/main/java/org/collectionspace/services/common/query/nuxeo/QueryManagerNuxeoImpl.java
+++ b/services/common/src/main/java/org/collectionspace/services/common/query/nuxeo/QueryManagerNuxeoImpl.java
@@ -68,6 +68,8 @@ public class QueryManagerNuxeoImpl implements IQueryManager {
        // HACK to work around Nuxeo regression that tokenizes on '.'. \r
        private static Pattern kwdSearchProblemChars = Pattern.compile("[\\:\\(\\)\\*\\%\\.]");\r
        private static Pattern kwdSearchHyphen = Pattern.compile(" - ");\r
+       private static Pattern advSearchSqlWildcard = Pattern.compile(".*?[I]*LIKE\\s*\\\"\\%\\\".*?");\r
+\r
 \r
        private static String getLikeForm(String dataSourceName, String repositoryName) {\r
                if (SEARCH_LIKE_FORM == null) {\r
@@ -84,6 +86,7 @@ public class QueryManagerNuxeoImpl implements IQueryManager {
                }\r
                return SEARCH_LIKE_FORM;\r
        }\r
+    private String SQL_WILDCARD_CHAR = "%";\r
 \r
        @Override\r
        public String getDatasourceName() {\r
@@ -135,9 +138,14 @@ public class QueryManagerNuxeoImpl implements IQueryManager {
        public String createWhereClauseFromAdvancedSearch(String advancedSearch) {\r
                String result = null;\r
                //\r
-               // Process search term.  FIXME: REM - Do we need to perform and string filtering here?\r
+               // Process search term.  FIXME: REM - Do we need to perform any string filtering here?\r
                //\r
                if (advancedSearch != null && !advancedSearch.isEmpty()) {\r
+                        // Filtering of advanced searches on a single '%' char, per CSPACE-5828\r
+                       Matcher regexMatcher = advSearchSqlWildcard.matcher(advancedSearch.trim());\r
+                        if (regexMatcher.matches()) {\r
+                            return "";\r
+                        }\r
                        StringBuffer advancedSearchWhereClause = new StringBuffer(\r
                                        advancedSearch);\r
                        result = advancedSearchWhereClause.toString();\r