Skip to content

[6.x] Fix Comb boolean words being used as raw regex - #15723

Open
edalzell wants to merge 3 commits into
statamic:6.xfrom
edalzell:fix/comb-quote-boolean-words
Open

edalzell wants to merge 3 commits into
statamic:6.xfrom
edalzell:fix/comb-quote-boolean-words

Conversation

@edalzell

@edalzell edalzell commented Oct 25, 2026 •

Copy link
Copy Markdown
Contributor

Comb builds the +required / -disallowed filters from the user's words without preg_quote, so metachars leak into the pattern. For example:

  • on an index with node.js guide and nodeXjs guide, the query guide -node.js drops both because . matches any character
  • +c++ compiles as c+ plus a possessive quantifier
  • +foo\ makes preg_match() emit No ending delimiter '#' found, which Laravel turns into a 500 for a user-typed search.

The fix is using preg_quote($word, '#') on the words in removeDisallowedMatches().

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant