diff --git a/CHANGELOG b/CHANGELOG index 261071937a39b3363b1ef6cfeb4b9d9c47bb5dbc..306ad2b1964f137c97a8824349f6d813ad05812b 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -12,6 +12,7 @@ v 8.12.0 (unreleased) - Change logo animation to CSS (ClemMakesApps) - Instructions for enabling Git packfile bitmaps !6104 - Fix pagination on user snippets page + - Escape search term before passing it to Regexp.new !6241 (winniehell) - Change merge_error column from string to text type - Reduce contributions calendar data payload (ClemMakesApps) - Add `web_url` field to issue, merge request, and snippet API objects (Ben Boeckel) diff --git a/app/helpers/search_helper.rb b/app/helpers/search_helper.rb index 4549c2e5bb6b20f390c293a10180f50cf6784659..e523c46e87930aa543925e0226218c419dee7c12 100644 --- a/app/helpers/search_helper.rb +++ b/app/helpers/search_helper.rb @@ -7,8 +7,10 @@ module SearchHelper projects_autocomplete(term) ].flatten + search_pattern = Regexp.new(Regexp.escape(term), "i") + generic_results = project_autocomplete + default_autocomplete + help_autocomplete - generic_results.select! { |result| result[:label] =~ Regexp.new(term, "i") } + generic_results.select! { |result| result[:label] =~ search_pattern } [ resources_results, diff --git a/spec/helpers/search_helper_spec.rb b/spec/helpers/search_helper_spec.rb index b0bb991539b38ca0fb189c96739f72aafec045c6..4b2ca3514f8effb288728470ea594375fe996795 100644 --- a/spec/helpers/search_helper_spec.rb +++ b/spec/helpers/search_helper_spec.rb @@ -32,6 +32,10 @@ describe SearchHelper do expect(search_autocomplete_opts("adm").size).to eq(1) end + it "does not allow regular expression in search term" do + expect(search_autocomplete_opts("(webhooks|api)").size).to eq(0) + end + it "includes the user's groups" do create(:group).add_owner(user) expect(search_autocomplete_opts("gro").size).to eq(1)