diff options
| author | MeiMei <30769358+mei23@users.noreply.github.com> | 2021-05-23 18:57:12 +0900 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-05-23 18:57:12 +0900 |
| commit | 47aaf044813662931fbaddd965272267fd94ed6a (patch) | |
| tree | 0f9194746dae5dcb1b37a1bcfb9b6c233d9e3f5d /src/server/api/endpoints | |
| parent | fix: Safariでもモーダルのぼかし効果が効くようにした (#7530) (diff) | |
| download | sharkey-47aaf044813662931fbaddd965272267fd94ed6a.tar.gz sharkey-47aaf044813662931fbaddd965272267fd94ed6a.tar.bz2 sharkey-47aaf044813662931fbaddd965272267fd94ed6a.zip | |
Fix search-by-tag (#7531)
* Fix search-by-tag
* Revert "Fix search-by-tag"
This reverts commit c971d1d5d82f2d8b58fdec76e42f4404339ab83a.
* Fix typo
* Remove unused var
* インジェクションは[]を返すように
Diffstat (limited to 'src/server/api/endpoints')
| -rw-r--r-- | src/server/api/endpoints/notes/search-by-tag.ts | 35 |
1 files changed, 19 insertions, 16 deletions
diff --git a/src/server/api/endpoints/notes/search-by-tag.ts b/src/server/api/endpoints/notes/search-by-tag.ts index 61f62dd5a6..463c5fff5a 100644 --- a/src/server/api/endpoints/notes/search-by-tag.ts +++ b/src/server/api/endpoints/notes/search-by-tag.ts @@ -104,22 +104,25 @@ export default define(meta, async (ps, me) => { generateVisibilityQuery(query, me); if (me) generateMutedUserQuery(query, me); - if (ps.tag) { - if (!safeForSql(ps.tag)) return; - query.andWhere(`'{"${normalizeForSearch(ps.tag)}"}' <@ note.tags`); - } else { - let i = 0; - query.andWhere(new Brackets(qb => { - for (const tags of ps.query!) { - qb.orWhere(new Brackets(qb => { - for (const tag of tags) { - if (!safeForSql(tag)) return; - qb.andWhere(`'{"${normalizeForSearch(ps.tag)}"}' <@ note.tags`); - i++; - } - })); - } - })); + try { + if (ps.tag) { + if (!safeForSql(ps.tag)) throw 'Injection'; + query.andWhere(`'{"${normalizeForSearch(ps.tag)}"}' <@ note.tags`); + } else { + query.andWhere(new Brackets(qb => { + for (const tags of ps.query!) { + qb.orWhere(new Brackets(qb => { + for (const tag of tags) { + if (!safeForSql(tag)) throw 'Injection'; + qb.andWhere(`'{"${normalizeForSearch(tag)}"}' <@ note.tags`); + } + })); + } + })); + } + } catch (e) { + if (e === 'Injection') return []; + throw e; } if (ps.reply != null) { |