5555import org .opensearch .client .opensearch ._types .query_dsl .TermQuery ;
5656
5757import com .google .common .annotations .VisibleForTesting ;
58+ import com .google .common .base .CharMatcher ;
5859import com .google .common .collect .ImmutableList ;
5960
6061public class CriterionConverter {
6162
63+ public static final CharMatcher QUERY_STRING_CONTROL_CHAR = CharMatcher .anyOf ("()\" ~-|*" );
6264 private final Map <Class <?>, Function <Criterion , Query >> criterionConverterMap ;
6365 private final Map <Class <?>, BiFunction <String , HeaderOperator , Query >> headerOperatorConverterMap ;
6466 private final String textFuzzinessSearchValue ;
@@ -224,7 +226,7 @@ private Query convertCustomFlagCriterion(SearchQuery.CustomFlagCriterion criteri
224226 private Query convertTextCriterion (SearchQuery .TextCriterion textCriterion ) {
225227 switch (textCriterion .getType ()) {
226228 case BODY :
227- if (useQueryStringQuery ) {
229+ if (useQueryStringQuery && QUERY_STRING_CONTROL_CHAR . matchesAnyOf ( textCriterion . getOperator (). getValue ()) ) {
228230 return new SimpleQueryStringQuery .Builder ()
229231 .fields (ImmutableList .of (JsonMessageConstants .TEXT_BODY , JsonMessageConstants .HTML_BODY ))
230232 .query (textCriterion .getOperator ().getValue ())
@@ -249,7 +251,7 @@ private Query convertTextCriterion(SearchQuery.TextCriterion textCriterion) {
249251 .toQuery ();
250252 }
251253 case FULL :
252- if (useQueryStringQuery ) {
254+ if (useQueryStringQuery && QUERY_STRING_CONTROL_CHAR . matchesAnyOf ( textCriterion . getOperator (). getValue ()) ) {
253255 return new SimpleQueryStringQuery .Builder ()
254256 .fields (ImmutableList .of (JsonMessageConstants .TEXT_BODY , JsonMessageConstants .HTML_BODY , JsonMessageConstants .ATTACHMENTS + "." + JsonMessageConstants .Attachment .TEXT_CONTENT ))
255257 .query (textCriterion .getOperator ().getValue ())
@@ -493,7 +495,7 @@ private Query convertHeader(SearchQuery.HeaderCriterion headerCriterion) {
493495 }
494496
495497 private Query convertSubject (SearchQuery .SubjectCriterion headerCriterion ) {
496- if (useQueryStringQuery ) {
498+ if (useQueryStringQuery && QUERY_STRING_CONTROL_CHAR . matchesAnyOf ( headerCriterion . getSubject ()) ) {
497499 return new QueryStringQuery .Builder ()
498500 .fields (ImmutableList .of (JsonMessageConstants .SUBJECT ))
499501 .query (headerCriterion .getSubject ())
0 commit comments