Skip to content

Conversation

@tomerqodo
Copy link

@tomerqodo tomerqodo commented Dec 4, 2025

User description

Benchmark PR getsentry#103379

Type: Clean (correct implementation)

Original PR Title: fix(search): Fix handle backslashes in wildcard operators
Original PR Description: When using one of the wildcard operators (contains, starts with, ends with), we need to make sure to properly escape backslashes in order to handle the search correctly.
Original PR URL: getsentry#103379


PR Type

Bug fix, Tests


Description

  • Fix backslash handling in wildcard operators (contains, starts_with, ends_with)

  • Add handle_backslash() function to properly escape backslashes in search values

  • Update escape validation to allow backslash as valid escape character

  • Add comprehensive tests for wildcard operators with backslash patterns


Diagram Walkthrough

flowchart LR
  A["Search Query with Backslash"] --> B["handle_backslash Function"]
  B --> C["Escape Validation Updated"]
  C --> D["Wildcard Operators"]
  D --> E["Test Coverage Added"]
Loading

File Walkthrough

Relevant files
Bug fix
event_search.py
Implement backslash escaping for wildcard operators           

src/sentry/api/event_search.py

  • Add handle_backslash() function to properly escape backslashes in
    wildcard search values
  • Update escape character validation in
    translate_wildcard_as_clickhouse_pattern() to accept backslash as
    valid escape character
  • Integrate handle_backslash() call in gen_wildcard_value() before regex
    substitution
+29/-1   
Tests
test_organization_group_index.py
Add wildcard operator backslash handling tests                     

tests/sentry/issues/endpoints/test_organization_group_index.py

  • Add test_wildcard_operator_with_backslash() test method to verify
    backslash handling
  • Test direct search with backslash pattern
  • Test wildcard operators (contains, starts_with, ends_with) with
    escaped backslashes
  • Verify correct event group matching for all backslash search patterns
+37/-0   
test_organization_events_span_indexed.py
Add span query backslash handling tests                                   

tests/snuba/api/endpoints/test_organization_events_span_indexed.py

  • Add test_wildcard_operator_with_backslash() test method for span
    queries
  • Test span description search with backslash patterns
  • Test all wildcard operators (contains, starts_with, ends_with) with
    escaped backslashes
  • Verify correct span matching across different backslash search
    patterns
+36/-0   

@qodo-code-review
Copy link

PR Compliance Guide 🔍

Below is a summary of compliance checks for this PR:

Security Compliance
🟢
No security concerns identified No security vulnerabilities detected by AI analysis. Human verification advised for critical code.
Ticket Compliance
🎫 No ticket provided
  • Create ticket/issue
Codebase Duplication Compliance
Codebase context is not defined

Follow the guide to enable codebase context checks.

Custom Compliance
🟢
Generic: Meaningful Naming and Self-Documenting Code

Objective: Ensure all identifiers clearly express their purpose and intent, making code
self-documenting

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Robust Error Handling and Edge Case Management

Objective: Ensure comprehensive error handling that provides meaningful context and graceful
degradation

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Secure Error Handling

Objective: To prevent the leakage of sensitive system information through error messages while
providing sufficient detail for internal debugging.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Security-First Input Validation and Data Handling

Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent
vulnerabilities

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Comprehensive Audit Trails

Objective: To create a detailed and reliable record of critical system actions for security analysis
and compliance.

Status:
No auditing: The new backslash handling and wildcard translation logic perform input transformations
without emitting any audit logs for critical actions, but it is unclear if such logging is
required for this layer.

Referred Code
def handle_backslash(value: str) -> str:
    # when working with one of the wildcard operators,
    # we need to ensure we properly handle backslashes
    # by escaping them

    v = []
    n = len(value)

    i = 0
    while i < n:
        c = value[i]
        if c == "\\":
            j = i + 1
            if j < n and value[j] in {"*", "\\"}:
                # found an escaped * or \
                v.append(c)
                i += 1
                c = value[i]
            else:
                # found just a \
                v.append("\\")


 ... (clipped 16 lines)

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Secure Logging Practices

Objective: To ensure logs are useful for debugging and auditing without exposing sensitive
information like PII, PHI, or cardholder data.

Status:
PII in tests: Tests introduce user identifiers and emails; while typical for fixtures, ensure no
sensitive real data is logged by the application during test execution.

Referred Code
data={
    "timestamp": before_now(seconds=1).isoformat(),
    "user": {
        "id": "1",
        "email": "[email protected]",
        "username": r"foo\bar",
        "ip_address": "192.168.0.1",
    },
},

Learn more about managing compliance generic rules or creating your own custom rules

Compliance status legend 🟢 - Fully Compliant
🟡 - Partial Compliant
🔴 - Not Compliant
⚪ - Requires Further Human Verification
🏷️ - Compliance label

@qodo-code-review
Copy link

PR Code Suggestions ✨

No code suggestions found for the PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants