From 37f2d05118fa98ee9cb68b8a51c6ae90612de813 Mon Sep 17 00:00:00 2001 From: Dan Brown Date: Sat, 6 Jun 2026 10:37:06 +0100 Subject: [PATCH] Search: Prevented tag search using unusable numbers These would trigger an error on use, and could be abused to fill logs. Added test to cover. Thanks to Stephen O. / Sakusen for reporting. --- app/Search/SearchRunner.php | 2 +- tests/Search/EntitySearchTest.php | 12 ++++++++++++ 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/app/Search/SearchRunner.php b/app/Search/SearchRunner.php index 391254172..d49cb439a 100644 --- a/app/Search/SearchRunner.php +++ b/app/Search/SearchRunner.php @@ -290,7 +290,7 @@ class SearchRunner $query->where('name', '=', $tagParts['name']); } - if (is_numeric($tagParts['value']) && $tagParts['operator'] !== 'like') { + if (is_numeric($tagParts['value']) && is_finite($tagParts['value']) && $tagParts['operator'] !== 'like') { // We have to do a raw sql query for this since otherwise PDO will quote the value and MySQL will // search the value as a string which prevents being able to do number-based operations // on the tag values. We ensure it has a numeric value and then cast it just to be sure. diff --git a/tests/Search/EntitySearchTest.php b/tests/Search/EntitySearchTest.php index fc300241b..d29c44eda 100644 --- a/tests/Search/EntitySearchTest.php +++ b/tests/Search/EntitySearchTest.php @@ -233,6 +233,18 @@ class EntitySearchTest extends TestCase $this->get('/search?term=' . urlencode('danzorbhsing {created_before:2037-01-01}'))->assertDontSee($page->name); } + public function test_search_tags_with_unexpected_numeric_values_does_not_cause_error() + { + $pageA = $this->entities->page(); + $pageA->name = 'MyTestPageWithAwkwardNumericTagValue'; + $pageA->save(); + $pageA->tags()->save(new Tag(['name' => 'Count', 'value' => '1E999'])); + + $resp = $this->asEditor()->get('/search?term=' . urlencode('[Count=1E999]')); + $resp->assertStatus(200); + $resp->assertSee('MyTestPageWithAwkwardNumericTagValue'); + } + public function test_entity_selector_search() { $page = $this->entities->newPage(['name' => 'my ajax search test', 'html' => 'ajax test']);