From 98dc3ab7ca7d27679bb161978dc2762d09b91c9b Mon Sep 17 00:00:00 2001 From: Hengfei Yang Date: Thu, 17 Sep 2026 07:04:04 +0000 Subject: [PATCH] fix(search): escape single quotes in the _values keyword filter (#14565) --- src/api/search/src/search/mod.rs | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/api/search/src/search/mod.rs b/src/api/search/src/search/mod.rs index 13b05701da..d533a25210 100644 --- a/src/api/search/src/search/mod.rs +++ b/src/api/search/src/search/mod.rs @@ -950,6 +950,8 @@ pub async fn build_search_request_per_field( }; let size = req.query.size; + // Escape single quotes so the keyword can't break out of the SQL string literal. + let keyword = keyword.replace('\'', "''"); let mut requests = Vec::new(); for field in fields { let sql_where = if !sql_where.is_empty() && !keyword.is_empty() { @@ -1048,9 +1050,10 @@ async fn values_inner( query_sql = sql; } + // Escape single quotes so the keyword can't break out of the SQL string literal. let keyword = match query.get("keyword") { None => "".to_string(), - Some(v) => v.trim().to_string(), + Some(v) => v.trim().replace('\'', "''"), }; let no_count = match query.get("no_count") { None => false,