diff --git a/app/models/user.rb b/app/models/user.rb index 8e0f18040..aeec196d9 100644 --- a/app/models/user.rb +++ b/app/models/user.rb @@ -185,6 +185,9 @@ class User < ApplicationRecord # => https://stackoverflow.com/a/11007216/4186181 # scope :search_by_name_and_username, lambda { |term| + term = term&.delete("\\") # prevents syntax error in tsquery + return none if term.blank? + where( sanitize_sql_array( [ diff --git a/spec/services/search/username_spec.rb b/spec/services/search/username_spec.rb index 0940d2a21..8ea430574 100644 --- a/spec/services/search/username_spec.rb +++ b/spec/services/search/username_spec.rb @@ -80,5 +80,9 @@ RSpec.describe Search::Username, type: :service do expect(results.size).to eq(max_results) expect([alex.username, alexsmith.username]).to include(results.first[:username]) end + + it "sanitizes the input when given slashes" do + expect(described_class.search_documents("\\")).to eq([]) + end end end