grafeo-ogm 1.7.2 → 1.7.4

package/dist/esm/utils/lucene.d.ts

@@ -1,9 +1,18 @@
 /**
  * Escapes special Lucene characters in a query string.
- * Special characters: + - && || ! ( ) { } [ ] ^ " ~ * ? : \ /
  *
- * Handles multi-character operators (&&, ||) as atomic units,
- * then escapes remaining individual special characters.
+ * Symbol-form operators escaped:
+ *   + - && || ! ( ) { } [ ] ^ " ~ * ? : \ /
+ *
+ * Bareword booleans (`AND`, `OR`, `NOT`, `TO`) are also neutralised. Pre-
+ * 1.7.3 they survived sanitisation, letting an attacker inject a boolean
+ * query (e.g. `foo AND _exists_:adminFlag`) even after symbol escaping.
+ * The standard Lucene analyser lowercases tokens during indexing, so
+ * lowercasing the bareword turns it into a literal-word match — which
+ * is what callers of `sanitizeLuceneQuery` expect (the function exists
+ * to make untrusted user input safe to pass to Lucene). Range-modifier
+ * boost/fuzzy (`^N`, `~N`) are already disarmed because `^` and `~`
+ * get backslash-escaped in the symbol pass.
  */
 export declare function sanitizeLuceneQuery(query: string): string;
 //# sourceMappingURL=lucene.d.ts.map

package/dist/esm/utils/lucene.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lucene.d.ts","sourceRoot":"","sources":["../../../src/utils/lucene.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAgBzD"}
+{"version":3,"file":"lucene.d.ts","sourceRoot":"","sources":["../../../src/utils/lucene.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAyBzD"}

package/dist/esm/utils/lucene.js

@@ -1,22 +1,37 @@
 /**
  * Escapes special Lucene characters in a query string.
- * Special characters: + - && || ! ( ) { } [ ] ^ " ~ * ? : \ /
  *
- * Handles multi-character operators (&&, ||) as atomic units,
- * then escapes remaining individual special characters.
+ * Symbol-form operators escaped:
+ *   + - && || ! ( ) { } [ ] ^ " ~ * ? : \ /
+ *
+ * Bareword booleans (`AND`, `OR`, `NOT`, `TO`) are also neutralised. Pre-
+ * 1.7.3 they survived sanitisation, letting an attacker inject a boolean
+ * query (e.g. `foo AND _exists_:adminFlag`) even after symbol escaping.
+ * The standard Lucene analyser lowercases tokens during indexing, so
+ * lowercasing the bareword turns it into a literal-word match — which
+ * is what callers of `sanitizeLuceneQuery` expect (the function exists
+ * to make untrusted user input safe to pass to Lucene). Range-modifier
+ * boost/fuzzy (`^N`, `~N`) are already disarmed because `^` and `~`
+ * get backslash-escaped in the symbol pass.
  */
 export function sanitizeLuceneQuery(query) {
-    // First pass: escape multi-char operators as atomic units
-    // Use placeholders to prevent double-escaping by the second pass
-    let result = query
-        .replace(/&&/g, '\u0000AND\u0000')
-        .replace(/\|\|/g, '\u0000OR\u0000');
-    // Second pass: escape individual special characters (& and | individually)
+    // FIRST pass: neutralise bareword booleans BEFORE the placeholder dance
+    // below. Running this last would let user-typed " AND " / " OR " collide
+    // with the restoration regex (which matches those exact tokens) and
+    // wrongly rewrite literal user words to escaped `\&\&` / `\|\|`. Running
+    // this first turns user `foo AND bar` into `foo and bar` (literal-word
+    // match) before any other pass sees it. Word boundaries (`\b`) keep us
+    // from touching middle-of-word matches like `BAND` or `STOP`.
+    let result = query.replace(/\b(AND|OR|NOT|TO)\b/g, (match) => match.toLowerCase());
+    // Second pass: escape multi-char operators as atomic units. We use
+    // " AND " / " OR " as placeholders (rather than NULL bytes) because
+    // the lowercase pass above guarantees no user-typed uppercase " AND "
+    // / " OR " can survive to collide with the restoration regex below.
+    result = result.replace(/&&/g, ' AND ').replace(/\|\|/g, ' OR ');
+    // Third pass: escape individual special characters (& and | individually)
     result = result.replace(/([+\-&|!(){}[\]^"~*?:\\/])/g, '\\$1');
-    // Restore multi-char operators with proper escaping
-    result = result
-        .replace(/\u0000AND\u0000/g, '\\&\\&')
-        .replace(/\u0000OR\u0000/g, '\\|\\|');
+    // Fourth pass: restore multi-char operators with proper escaping
+    result = result.replace(/ AND /g, '\\&\\&').replace(/ OR /g, '\\|\\|');
     return result;
 }
 //# sourceMappingURL=lucene.js.map

package/dist/esm/utils/lucene.js.map

@@ -1 +1 @@
-{"version":3,"file":"lucene.js","sourceRoot":"","sources":["../../../src/utils/lucene.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,0DAA0D;IAC1D,iEAAiE;IACjE,IAAI,MAAM,GAAG,KAAK;SACf,OAAO,CAAC,KAAK,EAAE,iBAAiB,CAAC;SACjC,OAAO,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAEtC,2EAA2E;IAC3E,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC;IAE/D,oDAAoD;IACpD,MAAM,GAAG,MAAM;SACZ,OAAO,CAAC,kBAAkB,EAAE,QAAQ,CAAC;SACrC,OAAO,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;IAExC,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"lucene.js","sourceRoot":"","sources":["../../../src/utils/lucene.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,wEAAwE;IACxE,yEAAyE;IACzE,oEAAoE;IACpE,yEAAyE;IACzE,uEAAuE;IACvE,uEAAuE;IACvE,8DAA8D;IAC9D,IAAI,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC3D,KAAK,CAAC,WAAW,EAAE,CACpB,CAAC;IAEF,mEAAmE;IACnE,oEAAoE;IACpE,sEAAsE;IACtE,oEAAoE;IACpE,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAEjE,0EAA0E;IAC1E,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC;IAE/D,iEAAiE;IACjE,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAEvE,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "grafeo-ogm",
-  "version": "1.7.2",
+  "version": "1.7.4",
   "description": "Type-safe Neo4j ORM / OGM for TypeScript. Define your graph in GraphQL SDL, get fully typed Prisma-like CRUD, optimized Cypher, and zero-config code generation. Community successor to @neo4j/graphql-ogm.",
   "license": "MIT",
   "author": "Alejandro Guzman",