DependencyTrack / DependencyTrack/dependency-track

Search API returns incorrect results when query contains special character

Open
#2,233 0 comments 0 reactions 0 assignees View on GitHub
defect in triage
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

Issue found while investigating https://github.com/DependencyTrack/dependency-track/discussions/2218

Reproduced using a portfolio with projects "a-a", "a-b", "a-c" and searching for "a-e". The generated query for [lucene](https://lucene.apache.org/core/2_9_4/queryparsersyntax.html) is incorrect. See in the picture below

![index-search-issue](https://user-images.githubusercontent.com/6144741/205514193-cf24dcbb-6bb5-424b-ab35-93878ffde80d.png)

It would essentially search for project having "a" or "e" in the name because the search query is tokenized, thus projects "a-a", "a-b", "a-c" are returned.

Resources used during initial analysis :

- https://lucene.apache.org/core/2_9_4/queryparsersyntax.html
- https://stackoverflow.com/questions/36068742/escaping-for-lucene-is-not-working
- https://www.baeldung.com/lucene-analyzers

### Steps to Reproduce

1. Create three projects with names "a-a", "a-b", "a-c"
2. Search for project "a-c" with the API /api/v1/search/project?query=a-b
3. The three projects are return

### Expected Behavior

No results should be returned or precisely the search query term should not be tokenized.

### Dependency-Track Version

4.7.0-SNAPSHOT

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

_No response_

### Browser

Google Chrome

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.