Add all Lucene special characters for escaping

Author: ineiti

src/app/core/shared/search/models/search-options.model.spec.ts

@@ -1,6 +1,101 @@
 import { DSpaceObjectType } from '../../dspace-object-type.model';
 import { SearchFilter } from './search-filter.model';
-import { SearchOptions } from './search-options.model';
+import {
+  escapeLuceneSpecialChars,
+  SearchOptions,
+} from './search-options.model';
+
+describe('escapeLuceneSpecialChars', () => {
+
+  it('should return plain text unchanged', () => {
+    expect(escapeLuceneSpecialChars('hello world')).toEqual('hello world');
+  });
+
+  it('should escape +', () => {
+    expect(escapeLuceneSpecialChars('a+b')).toEqual('a\\+b');
+  });
+
+  it('should escape -', () => {
+    expect(escapeLuceneSpecialChars('a-b')).toEqual('a\\-b');
+  });
+
+  it('should escape & (and thereby &&)', () => {
+    expect(escapeLuceneSpecialChars('a&&b')).toEqual('a\\&\\&b');
+  });
+
+  it('should escape | (and thereby ||)', () => {
+    expect(escapeLuceneSpecialChars('a||b')).toEqual('a\\|\\|b');
+  });
+
+  it('should escape !', () => {
+    expect(escapeLuceneSpecialChars('!a')).toEqual('\\!a');
+  });
+
+  it('should escape (', () => {
+    expect(escapeLuceneSpecialChars('(a')).toEqual('\\(a');
+  });
+
+  it('should escape )', () => {
+    expect(escapeLuceneSpecialChars('a)')).toEqual('a\\)');
+  });
+
+  it('should escape {', () => {
+    expect(escapeLuceneSpecialChars('{a')).toEqual('\\{a');
+  });
+
+  it('should escape }', () => {
+    expect(escapeLuceneSpecialChars('a}')).toEqual('a\\}');
+  });
+
+  it('should escape [', () => {
+    expect(escapeLuceneSpecialChars('[a')).toEqual('\\[a');
+  });
+
+  it('should escape ]', () => {
+    expect(escapeLuceneSpecialChars('a]')).toEqual('a\\]');
+  });
+
+  it('should escape ^', () => {
+    expect(escapeLuceneSpecialChars('^a')).toEqual('\\^a');
+  });
+
+  it('should escape "', () => {
+    expect(escapeLuceneSpecialChars('"a"')).toEqual('\\"a\\"');
+  });
+
+  it('should escape ~', () => {
+    expect(escapeLuceneSpecialChars('a~')).toEqual('a\\~');
+  });
+
+  it('should escape *', () => {
+    expect(escapeLuceneSpecialChars('a*')).toEqual('a\\*');
+  });
+
+  it('should escape ?', () => {
+    expect(escapeLuceneSpecialChars('a?')).toEqual('a\\?');
+  });
+
+  it('should escape :', () => {
+    expect(escapeLuceneSpecialChars('title:foo')).toEqual('title\\:foo');
+  });
+
+  it('should escape \\', () => {
+    expect(escapeLuceneSpecialChars('a\\b')).toEqual('a\\\\b');
+  });
+
+  it('should escape /', () => {
+    expect(escapeLuceneSpecialChars('a/b')).toEqual('a\\/b');
+  });
+
+  it('should escape multiple special characters in one string', () => {
+    expect(escapeLuceneSpecialChars('(hello+world)')).toEqual('\\(hello\\+world\\)');
+  });
+
+  it('should escape all special characters when they appear together', () => {
+    expect(escapeLuceneSpecialChars('+-&|!(){}[]^"~*?:\\/')).toEqual('\\+\\-\\&\\|\\!\\(\\)\\{\\}\\[\\]\\^\\"\\~\\*\\?\\:\\\\\\/');
+  });
+
+});
 
 describe('SearchOptions', () => {
   let options: SearchOptions;
@@ -40,5 +135,17 @@ describe('SearchOptions', () => {
       );
     });
 
+    it('should escape Lucene special characters in the query', () => {
+      const specialOptions = new SearchOptions({ query: 'title:foo (bar)+baz' });
+      const outcome = specialOptions.toRestUrl(baseUrl);
+      expect(outcome).toEqual('www.rest.com?query=title%5C%3Afoo%20%5C(bar%5C)%5C%2Bbaz');
+    });
+
+    it('should not escape the query when expert mode is enabled', () => {
+      const expertOptions = new SearchOptions({ query: 'title:foo', expert: true });
+      const outcome = expertOptions.toRestUrl(baseUrl);
+      expect(outcome).toEqual('www.rest.com?query=title%3Afoo');
+    });
+
   });
 });

src/app/core/shared/search/models/search-options.model.ts

@@ -8,6 +8,14 @@ import { DSpaceObjectType } from '../../dspace-object-type.model';
 import { ViewMode } from '../../view-mode.model';
 import { SearchFilter } from './search-filter.model';
 
+/**
+ * Escapes all Lucene special characters in a query string so they are treated as literals.
+ * Special characters: + - & | ! ( ) { } [ ] ^ " ~ * ? : \ /
+ */
+export function escapeLuceneSpecialChars(query: string): string {
+  return query.replace(/[+\-&|!(){}[\]^"~*?:\\/]/g, '\\$&');
+}
+
 /**
  * This model class represents all parameters needed to request information about a certain search request
  */
@@ -51,7 +59,7 @@ export class SearchOptions {
     }
     if (isNotEmpty(this.query)) {
       if (!this.expert) {
-        args.push(`query=${encodeURIComponent(this.query.replace(':', '\\:'))}`);
+        args.push(`query=${encodeURIComponent(escapeLuceneSpecialChars(this.query))}`);
       } else {
         args.push(`query=${encodeURIComponent(this.query)}`);
       }