diff --git a/lib/server-core/src/main/java/org/apache/olingo/server/core/uri/parser/search/SearchTokenizer.java b/lib/server-core/src/main/java/org/apache/olingo/server/core/uri/parser/search/SearchTokenizer.java index 9c818fc59..6a40e003b 100644 --- a/lib/server-core/src/main/java/org/apache/olingo/server/core/uri/parser/search/SearchTokenizer.java +++ b/lib/server-core/src/main/java/org/apache/olingo/server/core/uri/parser/search/SearchTokenizer.java @@ -21,6 +21,7 @@ package org.apache.olingo.server.core.uri.parser.search; import java.util.ArrayList; import java.util.List; + /** *
  * searchExpr    = ( OPEN BWS searchExpr BWS CLOSE / searchTerm )
@@ -121,7 +122,11 @@ public class SearchTokenizer {
     }
 
     static boolean isAllowedWord(final char character) {
-      return Character.isUnicodeIdentifierStart(character);
+      return Character.isUnicodeIdentifierStart(character)
+          || Character.DASH_PUNCTUATION == Character.getType(character)
+          || Character.DECIMAL_DIGIT_NUMBER == Character.getType(character) 
+          || (Character.OTHER_PUNCTUATION == Character.getType(character) && 
+          (character != ';' && character != '"'));
     }
     
     /**
@@ -614,6 +619,10 @@ public class SearchTokenizer {
    */
   public List tokenize(final String searchQuery) throws SearchTokenizerException {
 
+    if (searchQuery.contains("%28") || searchQuery.contains("%29") || searchQuery.contains("%22")) {
+      throw new SearchTokenizerException("Invalid Token in Query string '",
+          SearchTokenizerException.MessageKeys.NOT_EXPECTED_TOKEN, searchQuery);
+    }
     char[] chars = searchQuery.trim().toCharArray();
 
     State state = new SearchExpressionState();
diff --git a/lib/server-core/src/test/java/org/apache/olingo/server/core/uri/parser/search/SearchParserAndTokenizerTest.java b/lib/server-core/src/test/java/org/apache/olingo/server/core/uri/parser/search/SearchParserAndTokenizerTest.java
index f19fc826b..ce91a1b22 100644
--- a/lib/server-core/src/test/java/org/apache/olingo/server/core/uri/parser/search/SearchParserAndTokenizerTest.java
+++ b/lib/server-core/src/test/java/org/apache/olingo/server/core/uri/parser/search/SearchParserAndTokenizerTest.java
@@ -29,6 +29,7 @@ public class SearchParserAndTokenizerTest {
 
   @Test
   public void basicParsing() throws Exception {
+    assertQuery("99").resultsIn("'99'");
     assertQuery("\"99\"").resultsIn("'99'");
     assertQuery("a").resultsIn("'a'");
     assertQuery("a AND b").resultsIn("{'a' AND 'b'}");
@@ -83,7 +84,6 @@ public class SearchParserAndTokenizerTest {
 
   @Test
   public void invalidSearchQuery() throws Exception {
-    assertQuery("99").resultsIn(SearchParserException.MessageKeys.TOKENIZER_EXCEPTION);
     assertQuery("NOT").resultsIn(SearchParserException.MessageKeys.INVALID_NOT_OPERAND);
     assertQuery("AND").resultsInExpectedTerm(SearchQueryToken.Token.AND.name());
     assertQuery("OR").resultsInExpectedTerm(SearchQueryToken.Token.OR.name());
diff --git a/lib/server-core/src/test/java/org/apache/olingo/server/core/uri/parser/search/SearchTokenizerTest.java b/lib/server-core/src/test/java/org/apache/olingo/server/core/uri/parser/search/SearchTokenizerTest.java
index 23866e375..216323de2 100644
--- a/lib/server-core/src/test/java/org/apache/olingo/server/core/uri/parser/search/SearchTokenizerTest.java
+++ b/lib/server-core/src/test/java/org/apache/olingo/server/core/uri/parser/search/SearchTokenizerTest.java
@@ -54,16 +54,20 @@ public class SearchTokenizerTest {
     assertQuery("AN").resultsIn(word("AN"));
     assertQuery("O").resultsIn(word("O"));
     assertQuery("notAw0rd").resultsIn(word("notAw0rd"));
+    assertQuery("1").resultsIn(word("1"));
+    assertQuery("-").resultsIn(word("-"));
+    assertQuery("1.23a").resultsIn(word("1.23a"));
+    assertQuery(",").resultsIn(word(","));
+    assertQuery("*").resultsIn(word("*"));
     assertQuery("not,").resultsIn(word("not,"));
     assertQuery("not.").resultsIn(word("not."));
     assertQuery("B-B").resultsIn(word("B-B"));
     assertQuery("Dž").resultsIn(word("Dž"));
     // invalid
-    assertQuery("%2F").resultsIn(SearchTokenizerException.MessageKeys.FORBIDDEN_CHARACTER);
-    assertQuery("%3A").resultsIn(SearchTokenizerException.MessageKeys.FORBIDDEN_CHARACTER);
-    assertQuery("not%5B").resultsIn(SearchTokenizerException.MessageKeys.FORBIDDEN_CHARACTER);
-    assertQuery("not%7B").resultsIn(SearchTokenizerException.MessageKeys.FORBIDDEN_CHARACTER);
-    assertQuery("not%6A").resultsIn(SearchTokenizerException.MessageKeys.FORBIDDEN_CHARACTER);
+    assertQuery(";").resultsIn(SearchTokenizerException.MessageKeys.FORBIDDEN_CHARACTER);
+    assertQuery("%28").resultsIn(SearchTokenizerException.MessageKeys.NOT_EXPECTED_TOKEN);
+    assertQuery("%29").resultsIn(SearchTokenizerException.MessageKeys.NOT_EXPECTED_TOKEN);
+    assertQuery("not%22").resultsIn(SearchTokenizerException.MessageKeys.NOT_EXPECTED_TOKEN);
   }
 
   private Validator.Tuple word(final String literal) {
diff --git a/lib/server-test/src/test/java/org/apache/olingo/server/core/uri/parser/SearchParserTest.java b/lib/server-test/src/test/java/org/apache/olingo/server/core/uri/parser/SearchParserTest.java
index 743439a2e..417daa44c 100644
--- a/lib/server-test/src/test/java/org/apache/olingo/server/core/uri/parser/SearchParserTest.java
+++ b/lib/server-test/src/test/java/org/apache/olingo/server/core/uri/parser/SearchParserTest.java
@@ -89,7 +89,7 @@ public class SearchParserTest {
         .isExceptionMessage(SearchParserException.MessageKeys.TOKENIZER_EXCEPTION);
     testUri.runEx("ESTwoKeyNav", "$search=%22a%5Cbc%22")
         .isExceptionMessage(SearchParserException.MessageKeys.TOKENIZER_EXCEPTION);
-    testUri.runEx("ESTwoKeyNav", "$search=not%27allowed")
+    testUri.runEx("ESTwoKeyNav", "$search=not%28allowed")
         .isExceptionMessage(SearchParserException.MessageKeys.TOKENIZER_EXCEPTION);
   }