Vulnerability in EPiServer.Forms
We're having a problem with searches for queries like 3/4". What we want is products to be returned that have this text in any of the searched fields. For example, three quarter inch plumbing parts woudl be expected. What we get though are things that have 3/4" in our searched fields (that's what we want) but also anything that has a "3" or a "4" in the searched fields. This results in a significant amount of undesired/unrelated results.
I'm currently working on some new search code (Find) that exhibits this behavior:
var search = _searchClient.Search<BaseVariationContent>(Language.English);
var filters = filter == null ? null : Server.UrlDecode(filter).Split(',');
search = search.For(query)
.InField(x => x.WebDescription.ToString())
.InField(x => x.GetDisplayName())
.InField(x => x.Code)
.InField(x => x.ManufacturerPartNo)
.InField(x => x.CrossItems)
.InField(x => x.Type)
.BoostMatching(x => x.ProductCategoryField().SubCategoryName.MatchCaseInsensitive(query), 2)
.BoostMatching(x => x.Code.Match(query), 2)
.BoostMatching(x => x.CrossItems.Match(query), 1)
.BoostMatching(x => x.GetDisplayName().MatchCaseInsensitive(query), 2)
(x => x.Code, 2),
(x => x.CrossItems, 1),
(x => x.GetDisplayName(), 1)
.TermsFacetFor(x => x.ProductCategoryField().SubCategoryName);
if (filters != null && filters.Any())
var facetFilter = new FilterBuilder<BaseVariationContent>(search.Client);
foreach (var nextFilter in filters)
facetFilter = facetFilter.Or(x => x.ProductCategoryField().SubCategoryName.Match(nextFilter));
search = search.FilterHits(facetFilter);
var result = search.GetContentResult();
I've found that if I drop the double quote and surround the 3/4 in double quotes for the search (ie the search term becomes "3/4"), the results are much closer to what I expect.
It presents a problem though because 3/4" and 3/4 are not the same search term - they have different meanings. In this specific scenario, expected results are very similar but other examples like 8" - dropping the double quote that specifies inches could result in quite a bit of unexpected results. For example, I might expect 8" pliers but get results for MERV 8 air filters. (I know the example is a little weak but you get the idea)
Additionally, off the top of my head, it's going to be problematic to find these programatically and change them for the search.
Has anyone esle dealt with this?