fix: escape FTS5 queries to handle special characters

Wrap search queries in double quotes for FTS5 literal matching.
This prevents dots, colons, and other special characters from
being interpreted as FTS5 operators.

Fixes: "fts5: syntax error near '.'" when searching for option
paths like "services.nginx".

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit is contained in:
2026-02-03 18:09:32 +01:00
parent d82990fbfa
commit ec0eba4bef

View File

@@ -4,6 +4,7 @@ import (
"context" "context"
"database/sql" "database/sql"
"fmt" "fmt"
"strings"
_ "modernc.org/sqlite" _ "modernc.org/sqlite"
) )
@@ -323,7 +324,11 @@ func (s *SQLiteStore) SearchOptions(ctx context.Context, revisionID int64, query
WHERE o.revision_id = ? WHERE o.revision_id = ?
AND options_fts MATCH ?` AND options_fts MATCH ?`
args := []interface{}{revisionID, query} // Escape the query for FTS5 by wrapping in double quotes for literal matching.
// This prevents special characters (dots, colons, etc.) from being interpreted as operators.
// Also escape any double quotes within the query.
escapedQuery := `"` + strings.ReplaceAll(query, `"`, `""`) + `"`
args := []interface{}{revisionID, escapedQuery}
if filters.Type != "" { if filters.Type != "" {
baseQuery += " AND o.type = ?" baseQuery += " AND o.type = ?"