fix(api): escape ilike wildcards in admin list-query q params
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 82/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Quiet
- Tech stack
- postgresql, typescript
Research direction
Start with the q handling in packages/api/src/routes/admin/events/index.ts and packages/api/src/routes/admin/announcements/index.ts, then review the proposed shared helper in packages/api/src/lib/sql.ts. Escape %, _, and backslashes before interpolation, add a unit test covering a literal % in q, and verify both admin list queries treat these characters literally.
Written by the indexing model from the issue text.
Description
Summary
GET /admin/events?q= and GET /admin/announcements?q= pass raw user input into Drizzle's ilike(table.name, \%${q}%`). Postgres %and_ characters in the search string act as wildcards inside the pattern, so a search for \50% off` matches anything containing "50" then any 0+ chars then " off" — too broad.
Requirements
- Pre-escape
%,_, and\\in the rawqbefore pattern interpolation - Apply to both
packages/api/src/routes/admin/events/index.tsandpackages/api/src/routes/admin/announcements/index.ts - Add a unit test asserting
%insideqis treated literally
Context
Surfaced in the Plan 3 review (PR #1999). Plan 4 (forms) and Plan 5 (broadcast) will add more ilike filters; fix once before they land so the new code can copy the right pattern.
Implementation Notes
A small helper such as escapeIlike(s: string) in packages/api/src/lib/sql.ts (new file) keeps this consistent across routes.
- Dominant language
- HTML
- Stars
- 33
- Forks
- 104
- Avg merge
- 12h 3m
- Merged PRs (30d)
- 10
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from USRSE/usrse.github.io
-
Difficulty 1/5 Under an hour Newbie friendliness 85/100
USRSE/usrse.github.io#2001 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
USRSE/usrse.github.io#1991 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
USRSE/usrse.github.io#1948 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
USRSE/usrse.github.io#1947 · 1 comment ·
-
Difficulty 1/5 Under an hour Newbie friendliness 85/100
USRSE/usrse.github.io#1930 ·
All issues in USRSE/usrse.github.io
Similar issues
-
bug clawsweeper:linked-pr-open clawsweeper:needs-live-repro clawsweeper:no-new-fix-pr impact:message-loss issue-rating: 🐚 platinum hermit P2 regression
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
Difficulty 1/5 Under an hour Newbie friendliness 90/100
AXERA-TECH/ax-llm#77 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 90/100
games-on-whales/wolf#509 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 72/100