cozy-sharing 31.0.1 → 31.0.2

package/CHANGELOG.md

@@ -3,6 +3,12 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [31.0.2](https://github.com/cozy/cozy-libs/compare/cozy-sharing@31.0.1...cozy-sharing@31.0.2) (2026-05-07)
+
+### Bug Fixes
+
+- **cozy-sharing:** Escape user input in suggestion matchers ([d1bce0d](https://github.com/cozy/cozy-libs/commit/d1bce0d4426a04960e8e44d93b301c2f673e584e))
+
 ## [31.0.1](https://github.com/cozy/cozy-libs/compare/cozy-sharing@31.0.0...cozy-sharing@31.0.1) (2026-05-07)
 
 **Note:** Version bump only for package cozy-sharing

package/dist/suggestionMatchers.js

@@ -1,9 +1,10 @@
+import escapeRegExp from 'lodash/escapeRegExp';
 import { Group } from 'cozy-doctypes'; // TODO: sadly we have different versions of contacts' doctype to handle...
 // A migration tool on the stack side is needed here
 
 var emailMatch = function emailMatch(input, contact) {
   if (!contact.email) return false;
-  var emailInput = new RegExp(input, 'i');
+  var emailInput = new RegExp(escapeRegExp(input), 'i');
 
   if (Array.isArray(contact.email)) {
     return contact.email.some(function (email) {
@@ -16,7 +17,7 @@ var emailMatch = function emailMatch(input, contact) {
 
 var cozyUrlMatch = function cozyUrlMatch(input, contact) {
   if (!contact.cozy && !contact.url) return false;
-  var urlInput = new RegExp(input, 'i');
+  var urlInput = new RegExp(escapeRegExp(input), 'i');
 
   if (contact.cozy && Array.isArray(contact.cozy)) {
     return contact.cozy.some(function (cozy) {
@@ -29,13 +30,13 @@ var cozyUrlMatch = function cozyUrlMatch(input, contact) {
 
 var groupNameMatch = function groupNameMatch(input, contactOrGroup) {
   if (contactOrGroup._type !== Group.doctype) return false;
-  var nameInput = new RegExp(input, 'i');
+  var nameInput = new RegExp(escapeRegExp(input), 'i');
   return nameInput.test(contactOrGroup.name);
 };
 
 var fullnameMatch = function fullnameMatch(input, contact) {
   if (!contact.fullname) return false;
-  var fullnameInput = new RegExp(input, 'i');
+  var fullnameInput = new RegExp(escapeRegExp(input), 'i');
   return fullnameInput.test(contact.fullname);
 };
 

package/dist/suggestionMatchers.spec.js

@@ -72,6 +72,44 @@ describe('Suggestion matchers', function () {
       expect(result).toBe(false);
     });
   });
+  describe('with regex special characters in input', function () {
+    var contact = {
+      fullname: 'Jon (the) Snow*',
+      email: [{
+        address: 'jon+snow@winterfell.westeros'
+      }],
+      cozy: [{
+        url: 'https://jon.mycozy.cloud'
+      }]
+    };
+    var group = {
+      _type: 'io.cozy.contacts.groups',
+      name: 'House (Stark)'
+    };
+    it('should not throw on unbalanced parentheses', function () {
+      expect(function () {
+        return matchers.emailMatch('foo (bar', contact);
+      }).not.toThrow();
+      expect(function () {
+        return matchers.cozyUrlMatch('foo (bar', contact);
+      }).not.toThrow();
+      expect(function () {
+        return matchers.fullnameMatch('foo (bar', contact);
+      }).not.toThrow();
+      expect(function () {
+        return matchers.groupNameMatch('foo (bar', group);
+      }).not.toThrow();
+    });
+    it('should match special chars literally instead of as regex', function () {
+      expect(matchers.fullnameMatch('(the)', contact)).toBe(true);
+      expect(matchers.fullnameMatch('Snow*', contact)).toBe(true);
+      expect(matchers.emailMatch('jon+snow', contact)).toBe(true);
+      expect(matchers.groupNameMatch('(Stark)', group)).toBe(true);
+    });
+    it('should not let . match any character', function () {
+      expect(matchers.fullnameMatch('J.n', contact)).toBe(false);
+    });
+  });
   describe('fullnameMatch', function () {
     it('should return false if no fullname or no match', function () {
       var contact = {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cozy-sharing",
-  "version": "31.0.1",
+  "version": "31.0.2",
   "description": "Provides sharing login for React applications.",
   "main": "dist/index.js",
   "author": "Cozy",
@@ -84,5 +84,5 @@
   "sideEffects": [
     "*.css"
   ],
-  "gitHead": "e0e319b6aa9ff9125441b43c1c68d31ea6b25103"
+  "gitHead": "cf80a630e5308718b52411e3792f145041d94170"
 }

package/src/suggestionMatchers.js

@@ -1,10 +1,12 @@
+import escapeRegExp from 'lodash/escapeRegExp'
+
 import { Group } from 'cozy-doctypes'
 
 // TODO: sadly we have different versions of contacts' doctype to handle...
 // A migration tool on the stack side is needed here
 const emailMatch = (input, contact) => {
   if (!contact.email) return false
-  const emailInput = new RegExp(input, 'i')
+  const emailInput = new RegExp(escapeRegExp(input), 'i')
   if (Array.isArray(contact.email)) {
     return contact.email.some(email => emailInput.test(email.address))
   }
@@ -13,7 +15,7 @@ const emailMatch = (input, contact) => {
 
 const cozyUrlMatch = (input, contact) => {
   if (!contact.cozy && !contact.url) return false
-  const urlInput = new RegExp(input, 'i')
+  const urlInput = new RegExp(escapeRegExp(input), 'i')
   if (contact.cozy && Array.isArray(contact.cozy)) {
     return contact.cozy.some(cozy => urlInput.test(cozy.url))
   }
@@ -22,13 +24,13 @@ const cozyUrlMatch = (input, contact) => {
 
 const groupNameMatch = (input, contactOrGroup) => {
   if (contactOrGroup._type !== Group.doctype) return false
-  const nameInput = new RegExp(input, 'i')
+  const nameInput = new RegExp(escapeRegExp(input), 'i')
   return nameInput.test(contactOrGroup.name)
 }
 
 const fullnameMatch = (input, contact) => {
   if (!contact.fullname) return false
-  const fullnameInput = new RegExp(input, 'i')
+  const fullnameInput = new RegExp(escapeRegExp(input), 'i')
   return fullnameInput.test(contact.fullname)
 }
 

package/src/suggestionMatchers.spec.js

@@ -95,6 +95,36 @@ describe('Suggestion matchers', () => {
     })
   })
 
+  describe('with regex special characters in input', () => {
+    const contact = {
+      fullname: 'Jon (the) Snow*',
+      email: [{ address: 'jon+snow@winterfell.westeros' }],
+      cozy: [{ url: 'https://jon.mycozy.cloud' }]
+    }
+    const group = {
+      _type: 'io.cozy.contacts.groups',
+      name: 'House (Stark)'
+    }
+
+    it('should not throw on unbalanced parentheses', () => {
+      expect(() => matchers.emailMatch('foo (bar', contact)).not.toThrow()
+      expect(() => matchers.cozyUrlMatch('foo (bar', contact)).not.toThrow()
+      expect(() => matchers.fullnameMatch('foo (bar', contact)).not.toThrow()
+      expect(() => matchers.groupNameMatch('foo (bar', group)).not.toThrow()
+    })
+
+    it('should match special chars literally instead of as regex', () => {
+      expect(matchers.fullnameMatch('(the)', contact)).toBe(true)
+      expect(matchers.fullnameMatch('Snow*', contact)).toBe(true)
+      expect(matchers.emailMatch('jon+snow', contact)).toBe(true)
+      expect(matchers.groupNameMatch('(Stark)', group)).toBe(true)
+    })
+
+    it('should not let . match any character', () => {
+      expect(matchers.fullnameMatch('J.n', contact)).toBe(false)
+    })
+  })
+
   describe('fullnameMatch', () => {
     it('should return false if no fullname or no match', () => {
       const contact = {}