core: escape special characters in SQL search query (streetwriters#7418)

Signed-off-by: Luis Kriner <[email protected]>
01zulfi · Feb 11, 2025 · 43356e5 · 43356e5
1 parent 7b13f35
commit 43356e5
Showing 1 changed file with 1 addition and 5 deletions.
diff --git a/packages/core/src/utils/query-transformer.ts b/packages/core/src/utils/query-transformer.ts
@@ -39,11 +39,7 @@ function escapeSQLString(str: string): string {
     return `"${innerStr}"`;
   }
 
-  const maybeColspec =
-    str.includes(":") ||
-    str.includes(">") ||
-    str.includes("<") ||
-    str.includes("-");
+  const maybeColspec = /[:<>./\\()$&=#!\-\+\~§@^?,;'"\[\]{}|]/.test(str);
   const isWildcard =
     str.startsWith("*") ||
     str.endsWith("*") ||