forest_liana 9.20.8 → 9.20.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dfcdfafce741a2f8305f64a7241219a6f9b54227dd310dd7269ff83043f0f35d
-  data.tar.gz: c3ce3c647b53d3cc7bd8c5d45ed98c887588112c6e5e7fc558ca6ca5ddf385f2
+  metadata.gz: 8081936e6d6a125213c778a94576d1eaaf5560eb838a89563a6e113ab79a2e46
+  data.tar.gz: b5cb7df552d00872c40981ee37009b534bb5a254ee637d7dd39dd71b840f6124
 SHA512:
-  metadata.gz: debd8bdb65d707795b7e895769c3ec1bd1fc0796bc971edfad2d0446a6b19e1b2b78bdd1c64cd77b2dc615eecc5384b868d1e8ab01810646aa287fd8c7c1a1f1
-  data.tar.gz: 9534d5fd16d409d282dd806955386e730a428c3c8405b0beb0284bd317f6825a8f5cdf616ca662e4148a8df9703b23e0370772edd9a35d9c6dbca9e5fe72ff76
+  metadata.gz: a1e231f576b02caed5a80f12fff4d6baabd4355ef9f5aae79afb3f4a6663e29cda2cdd078088e4949d42435c1bcf8f28b82bc7c90c619f971e17da7fa81bd45a
+  data.tar.gz: 0a93106150c9ead61198c464baaab09c0eb0974abc5c78570e980baa48bd3a05bdb4677720fa8b35704375665c06b297cad763325249601d08962222a9c444d4

data/app/services/forest_liana/search_query_builder.rb

@@ -85,7 +85,7 @@ module ForestLiana
             !@resource.defined_enums[column.name][@search.downcase].nil?
             conditions << "#{column_name} =
               #{@resource.defined_enums[column.name][@search.downcase]}"
-          elsif !(column.respond_to?(:array) && column.array) && text_type?(column.type)
+          elsif !(column.respond_to?(:array) && column.array) && text_type?(column.type) && !malformed_uuid_search?
             conditions << "LOWER(#{column_name}) LIKE :search_value_for_string"
           end
         end
@@ -114,7 +114,7 @@ module ForestLiana
               resource = @resource.reflect_on_association(association.to_sym)
               unless (SchemaUtils.polymorphic?(resource))
                 resource.klass.columns.each do |column|
-                  if !(column.respond_to?(:array) && column.array) && text_type?(column.type)
+                  if !(column.respond_to?(:array) && column.array) && text_type?(column.type) && !malformed_uuid_search?
                     if @collection.search_fields.nil? || (association_search &&
                       association_search.include?(column.name))
                       conditions << association_search_condition(resource.table_name,
@@ -138,7 +138,7 @@ module ForestLiana
               unless association_search.empty?
                 resource = @resource.reflect_on_association(association.to_sym)
                 resource.klass.columns.each do |column|
-                  if !(column.respond_to?(:array) && column.array) && text_type?(column.type)
+                  if !(column.respond_to?(:array) && column.array) && text_type?(column.type) && !malformed_uuid_search?
                     if association_search.include?(column.name)
                       conditions << association_search_condition(resource.table_name,
                         column.name)
@@ -150,11 +150,18 @@ module ForestLiana
           end
         end
 
-        @records = @resource.where(
-          conditions.join(' OR '),
-          search_value_for_string: "%#{@search.downcase}%",
-          search_value_for_uuid: @search.to_s
-        ) unless conditions.empty?
+        if conditions.empty?
+          # NOTICE: a malformed-UUID search suppresses the only conditions it could
+          #         have produced (text LIKE scans); match nothing rather than fall
+          #         through to an unfiltered query that returns the whole table.
+          @records = @resource.none if malformed_uuid_search?
+        else
+          @records = @resource.where(
+            conditions.join(' OR '),
+            search_value_for_string: "%#{@search.downcase}%",
+            search_value_for_uuid: @search.to_s
+          )
+        end
       end
 
       @records
@@ -223,5 +230,17 @@ module ForestLiana
     def text_type?(type_sym)
       [:string, :text, :citext].include? type_sym
     end
+
+    # NOTICE: A search that is UUID-shaped but fails the strict REGEX_UUID (a
+    #         truncated or mistyped UUID) can never match a real UUID column and,
+    #         on text columns, only triggers `LOWER(col) LIKE '%…%'` sequential
+    #         scans that can hit the statement timeout. Valid UUIDs are excluded
+    #         so they keep matching UUIDs stored in varchar/text columns.
+    def malformed_uuid_search?
+      return false unless @search.is_a?(String)
+
+      @search.match?(/\A[0-9a-f]+-[0-9a-f]+-[0-9a-f]+-[0-9a-f]+-[0-9a-f]+\z/i) &&
+        !REGEX_UUID.match?(@search)
+    end
   end
 end

data/lib/forest_liana/version.rb

@@ -1,3 +1,3 @@
 module ForestLiana
-  VERSION = "9.20.8"
+  VERSION = "9.20.9"
 end

data/spec/services/forest_liana/search_query_builder_spec.rb

@@ -16,6 +16,50 @@ module ForestLiana
     end
 
     describe '#perform' do
+      context 'when the search is a malformed UUID' do
+        # UUID-shaped but fails the strict REGEX_UUID (mistyped/truncated group).
+        # Starts with a letter so #to_i is 0 and adds no integer-`id` condition,
+        # leaving the text LIKE scans as the only possible matches.
+        let(:params) { { search: 'abcdef12-3456-4ae-ad4f-5662757713a2', searchExtended: '0' } }
+
+        before do
+          Tree.create!(name: 'Oak')
+          Tree.create!(name: 'Elm')
+        end
+
+        after { Tree.destroy_all }
+
+        it 'matches nothing instead of returning the unfiltered table' do
+          expect(builder.perform(Tree.all).count).to eq(0)
+        end
+      end
+
+      context 'when searchExtended is on and the search is a malformed UUID' do
+        # HashWithIndifferentAccess: the code reads @params['searchExtended'] (string).
+        let(:params) do
+          ActiveSupport::HashWithIndifferentAccess.new(
+            search: 'abcdef12-3456-4ae-ad4f-5662757713a2', searchExtended: '1'
+          )
+        end
+        let(:builder) { described_class.new(params, [:owner], collection, user) }
+
+        before { Tree.create!(name: 'Oak') }
+
+        after { Tree.destroy_all }
+
+        it 'does not build LIKE scans on associated text columns either' do
+          expect(builder.perform(Tree.all).to_sql).not_to match(/LIKE/i)
+        end
+      end
+
+      context 'when the search is a valid UUID' do
+        let(:params) { { search: '75fbcb43-f6f8-4cd1-861f-09a61fd1ddad', searchExtended: '0' } }
+
+        it 'still builds a LIKE scan on text columns (UUIDs stored as text)' do
+          expect(builder.perform(Tree.all).to_sql).to match(/LIKE/i)
+        end
+      end
+
       context 'when a column is an array uuid type' do
         let(:array_uuid_column) do
           double('Column', name: 'attachment_ids', type: :uuid, array: true).tap do |col|

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: forest_liana
 version: !ruby/object:Gem::Version
-  version: 9.20.8
+  version: 9.20.9
 platform: ruby
 authors:
 - Sandro Munda