diff --git a/lib/server-core/src/main/java/org/apache/olingo/server/core/uri/parser/search/SearchTokenizer.java b/lib/server-core/src/main/java/org/apache/olingo/server/core/uri/parser/search/SearchTokenizer.java index 9c818fc59..6a40e003b 100644 --- a/lib/server-core/src/main/java/org/apache/olingo/server/core/uri/parser/search/SearchTokenizer.java +++ b/lib/server-core/src/main/java/org/apache/olingo/server/core/uri/parser/search/SearchTokenizer.java @@ -21,6 +21,7 @@ package org.apache.olingo.server.core.uri.parser.search; import java.util.ArrayList; import java.util.List; + /** *
* searchExpr = ( OPEN BWS searchExpr BWS CLOSE / searchTerm ) @@ -121,7 +122,11 @@ public class SearchTokenizer { } static boolean isAllowedWord(final char character) { - return Character.isUnicodeIdentifierStart(character); + return Character.isUnicodeIdentifierStart(character) + || Character.DASH_PUNCTUATION == Character.getType(character) + || Character.DECIMAL_DIGIT_NUMBER == Character.getType(character) + || (Character.OTHER_PUNCTUATION == Character.getType(character) && + (character != ';' && character != '"')); } /** @@ -614,6 +619,10 @@ public class SearchTokenizer { */ public Listtokenize(final String searchQuery) throws SearchTokenizerException { + if (searchQuery.contains("%28") || searchQuery.contains("%29") || searchQuery.contains("%22")) { + throw new SearchTokenizerException("Invalid Token in Query string '", + SearchTokenizerException.MessageKeys.NOT_EXPECTED_TOKEN, searchQuery); + } char[] chars = searchQuery.trim().toCharArray(); State state = new SearchExpressionState(); diff --git a/lib/server-core/src/test/java/org/apache/olingo/server/core/uri/parser/search/SearchParserAndTokenizerTest.java b/lib/server-core/src/test/java/org/apache/olingo/server/core/uri/parser/search/SearchParserAndTokenizerTest.java index f19fc826b..ce91a1b22 100644 --- a/lib/server-core/src/test/java/org/apache/olingo/server/core/uri/parser/search/SearchParserAndTokenizerTest.java +++ b/lib/server-core/src/test/java/org/apache/olingo/server/core/uri/parser/search/SearchParserAndTokenizerTest.java @@ -29,6 +29,7 @@ public class SearchParserAndTokenizerTest { @Test public void basicParsing() throws Exception { + assertQuery("99").resultsIn("'99'"); assertQuery("\"99\"").resultsIn("'99'"); assertQuery("a").resultsIn("'a'"); assertQuery("a AND b").resultsIn("{'a' AND 'b'}"); @@ -83,7 +84,6 @@ public class SearchParserAndTokenizerTest { @Test public void invalidSearchQuery() throws Exception { - assertQuery("99").resultsIn(SearchParserException.MessageKeys.TOKENIZER_EXCEPTION); assertQuery("NOT").resultsIn(SearchParserException.MessageKeys.INVALID_NOT_OPERAND); assertQuery("AND").resultsInExpectedTerm(SearchQueryToken.Token.AND.name()); assertQuery("OR").resultsInExpectedTerm(SearchQueryToken.Token.OR.name()); diff --git a/lib/server-core/src/test/java/org/apache/olingo/server/core/uri/parser/search/SearchTokenizerTest.java b/lib/server-core/src/test/java/org/apache/olingo/server/core/uri/parser/search/SearchTokenizerTest.java index 23866e375..216323de2 100644 --- a/lib/server-core/src/test/java/org/apache/olingo/server/core/uri/parser/search/SearchTokenizerTest.java +++ b/lib/server-core/src/test/java/org/apache/olingo/server/core/uri/parser/search/SearchTokenizerTest.java @@ -54,16 +54,20 @@ public class SearchTokenizerTest { assertQuery("AN").resultsIn(word("AN")); assertQuery("O").resultsIn(word("O")); assertQuery("notAw0rd").resultsIn(word("notAw0rd")); + assertQuery("1").resultsIn(word("1")); + assertQuery("-").resultsIn(word("-")); + assertQuery("1.23a").resultsIn(word("1.23a")); + assertQuery(",").resultsIn(word(",")); + assertQuery("*").resultsIn(word("*")); assertQuery("not,").resultsIn(word("not,")); assertQuery("not.").resultsIn(word("not.")); assertQuery("B-B").resultsIn(word("B-B")); assertQuery("Dž").resultsIn(word("Dž")); // invalid - assertQuery("%2F").resultsIn(SearchTokenizerException.MessageKeys.FORBIDDEN_CHARACTER); - assertQuery("%3A").resultsIn(SearchTokenizerException.MessageKeys.FORBIDDEN_CHARACTER); - assertQuery("not%5B").resultsIn(SearchTokenizerException.MessageKeys.FORBIDDEN_CHARACTER); - assertQuery("not%7B").resultsIn(SearchTokenizerException.MessageKeys.FORBIDDEN_CHARACTER); - assertQuery("not%6A").resultsIn(SearchTokenizerException.MessageKeys.FORBIDDEN_CHARACTER); + assertQuery(";").resultsIn(SearchTokenizerException.MessageKeys.FORBIDDEN_CHARACTER); + assertQuery("%28").resultsIn(SearchTokenizerException.MessageKeys.NOT_EXPECTED_TOKEN); + assertQuery("%29").resultsIn(SearchTokenizerException.MessageKeys.NOT_EXPECTED_TOKEN); + assertQuery("not%22").resultsIn(SearchTokenizerException.MessageKeys.NOT_EXPECTED_TOKEN); } private Validator.Tuple word(final String literal) { diff --git a/lib/server-test/src/test/java/org/apache/olingo/server/core/uri/parser/SearchParserTest.java b/lib/server-test/src/test/java/org/apache/olingo/server/core/uri/parser/SearchParserTest.java index 743439a2e..417daa44c 100644 --- a/lib/server-test/src/test/java/org/apache/olingo/server/core/uri/parser/SearchParserTest.java +++ b/lib/server-test/src/test/java/org/apache/olingo/server/core/uri/parser/SearchParserTest.java @@ -89,7 +89,7 @@ public class SearchParserTest { .isExceptionMessage(SearchParserException.MessageKeys.TOKENIZER_EXCEPTION); testUri.runEx("ESTwoKeyNav", "$search=%22a%5Cbc%22") .isExceptionMessage(SearchParserException.MessageKeys.TOKENIZER_EXCEPTION); - testUri.runEx("ESTwoKeyNav", "$search=not%27allowed") + testUri.runEx("ESTwoKeyNav", "$search=not%28allowed") .isExceptionMessage(SearchParserException.MessageKeys.TOKENIZER_EXCEPTION); }