@formio/uag 1.12.1 → 1.12.2

package/lib/tools/fetchExternalData.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.fetchExternalData = void 0;
 const template_1 = require("../template");
+const utils_1 = require("./utils");
 const core_1 = require("@formio/core");
 const SchemaBuilder_1 = require("./SchemaBuilder");
 const lodash_1 = require("lodash");
@@ -251,7 +252,7 @@ async function fetchResourceData(component, search_value, authInfo, project, con
     const query = {};
     // Add search filter if provided
     if (search_value && component.searchField) {
-        query[`data.${component.searchField}__regex`] = `/${search_value}/i`;
+        query[`data.${component.searchField}__regex`] = `/${(0, utils_1.escapeSearchPattern)(search_value)}/i`;
     }
     // Add component filter if configured (interpolate the filter string)
     if (component.filter) {

package/lib/tools/findSubmission.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.findSubmission = void 0;
 const template_1 = require("../template");
+const utils_1 = require("./utils");
 const lodash_1 = require("lodash");
 const SchemaBuilder_1 = require("./SchemaBuilder");
 const error = require('debug')('formio:uag:findSubmission:error');
@@ -34,19 +35,33 @@ const findSubmission = async (project) => {
                         }, true);
                     }
                     if (criterion.operator === 'regex') {
+                        // The value is a pattern by request here, so it is passed through
+                        // unescaped. It is still compiled first: the server drops a filter
+                        // it cannot compile, which would widen the search instead of
+                        // failing it, so a bad pattern is better reported back.
+                        try {
+                            new RegExp(criterion.search_value);
+                        }
+                        catch (err) {
+                            return project.mcpResponse(template_1.ResponseTemplate.submissionSearchError, {
+                                form: form.form,
+                                searchQuery: search_query,
+                                error: `"${criterion.search_value}" is not a valid regular expression for "${criterion.data_path}". Use the "contains" operator to search for it literally.`
+                            }, true);
+                        }
                         query[`data.${criterion.data_path}__regex`] = `/${criterion.search_value}/i`;
                     }
                     else if (criterion.operator === 'equals') {
                         query[`data.${criterion.data_path}`] = criterion.search_value;
                     }
                     else if (criterion.operator === 'contains') {
-                        query[`data.${criterion.data_path}__regex`] = `/${criterion.search_value}/i`;
+                        query[`data.${criterion.data_path}__regex`] = `/${(0, utils_1.escapeSearchPattern)(criterion.search_value)}/i`;
                     }
                     else if (criterion.operator === 'starts_with') {
-                        query[`data.${criterion.data_path}__regex`] = `/^${criterion.search_value}/i`;
+                        query[`data.${criterion.data_path}__regex`] = `/^${(0, utils_1.escapeSearchPattern)(criterion.search_value)}/i`;
                     }
                     else if (criterion.operator === 'ends_with') {
-                        query[`data.${criterion.data_path}__regex`] = `/${criterion.search_value}$/i`;
+                        query[`data.${criterion.data_path}__regex`] = `/${(0, utils_1.escapeSearchPattern)(criterion.search_value)}$/i`;
                     }
                     else if (criterion.operator === 'greater_than') {
                         query[`data.${criterion.data_path}__gt`] = criterion.search_value;

package/lib/tools/utils.d.ts

@@ -1,4 +1,24 @@
 import { ZodRawShape } from "zod";
+/**
+ * Escape a literal value so it can be carried in a `__regex` query parameter.
+ *
+ * Operators like "contains" promise a literal match, so every regular expression
+ * metacharacter in the value has to be neutered first. Left raw, a search for
+ * "joe.thompson@example.com" becomes a pattern whose dots match any character,
+ * and a value such as "[" is not a valid pattern at all — the server compiles
+ * these with a try/catch and silently drops the filter when compilation fails,
+ * which turns a narrow search into one that matches everything.
+ *
+ * Forward slashes get a further step. The server reads the parameter as
+ * `/pattern/flags` and takes the pattern with `[^/]+`, so an embedded slash
+ * truncates the pattern and the remainder is parsed as flags — again dropping
+ * the filter. Writing it as the equivalent `\x2f` escape keeps the character
+ * out of the transport while still matching a literal slash.
+ *
+ * @param value - The literal text to search for.
+ * @returns The value as a regular expression pattern that matches it literally.
+ */
+export declare const escapeSearchPattern: (value: string) => string;
 export type ToolInfo = {
     name?: string;
     title?: string;

package/lib/tools/utils.js

@@ -1,2 +1,25 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.escapeSearchPattern = void 0;
+const lodash_1 = require("lodash");
+/**
+ * Escape a literal value so it can be carried in a `__regex` query parameter.
+ *
+ * Operators like "contains" promise a literal match, so every regular expression
+ * metacharacter in the value has to be neutered first. Left raw, a search for
+ * "joe.thompson@example.com" becomes a pattern whose dots match any character,
+ * and a value such as "[" is not a valid pattern at all — the server compiles
+ * these with a try/catch and silently drops the filter when compilation fails,
+ * which turns a narrow search into one that matches everything.
+ *
+ * Forward slashes get a further step. The server reads the parameter as
+ * `/pattern/flags` and takes the pattern with `[^/]+`, so an embedded slash
+ * truncates the pattern and the remainder is parsed as flags — again dropping
+ * the filter. Writing it as the equivalent `\x2f` escape keeps the character
+ * out of the transport while still matching a literal slash.
+ *
+ * @param value - The literal text to search for.
+ * @returns The value as a regular expression pattern that matches it literally.
+ */
+const escapeSearchPattern = (value) => (0, lodash_1.escapeRegExp)(value).replace(/\//g, '\\x2f');
+exports.escapeSearchPattern = escapeSearchPattern;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@formio/uag",
-  "version": "1.12.1",
+  "version": "1.12.2",
   "mcpName": "io.form/uag",
   "description": "The Form.io Universal Agent Gateway (UAG).",
   "main": "lib/index.js",
@@ -30,7 +30,7 @@
   "author": "Form.io Developers",
   "license": "MIT",
   "dependencies": {
-    "@formio/appserver": "^2.13.1",
+    "@formio/appserver": "^2.13.2",
     "@formio/core": "2.8.0",
     "@modelcontextprotocol/sdk": "1.30.0",
     "cors": "^2.8.6",