Audit follow-up: PageResource searchPage returns 500 for invalid path and can malformed-query via path

Parent epic: #36004

Finding

PageResource.searchPage passes nullable / short path values to getPageByPathESQuery, which appears to call pathParam.startsWith("//") and index into pathSplit[2]. The audit also notes path is interpolated into a Lucene query_string with incomplete escaping.

Report references: dotCMS/src/main/java/com/dotcms/rest/api/v1/page/PageResource.java:1041-1058, dotCMS/src/main/java/com/dotcms/rest/api/v1/page/PageResource.java:1238-1259

Potential impact

Authenticated backend users can trigger 500s with missing or short paths such as absent path, //, or //host. Quotes/backslashes may also produce malformed Lucene query failures. The report frames this as robustness/availability, not cross-tenant access, because permission filtering still applies.

Suggested validation

Call the endpoint with missing path, //, //host, and Lucene-special characters and confirm response codes / logs.

Possible fix

Reject blank or malformed path with 400, guard pathSplit.length, and escape Lucene query-string special characters such as " and \.

Caveat

This was AI-found by Claude from .scratch/audit/REPORT.md. Please perform secondary validation of correctness, severity, and value before actioning.

Start with PageResource.java:1041-1058 and 1238-1259, tracing PageResource.searchPage into getPageByPathESQuery. Validate requests with missing path, //, //host, and Lucene-special characters, then confirm malformed inputs return 400 without 500s or malformed-query failures while permission filtering remains intact.