@formio/uag - npm Package Compare versions

Comparing version 1.12.1 to 1.12.2

lib/tools/fetchExternalData.js

@@ -5,2 +5,3 @@ "use strict";
 const template_1 = require("../template");
+const utils_1 = require("./utils");
 const core_1 = require("@formio/core");
@@ -255,3 +256,3 @@ const SchemaBuilder_1 = require("./SchemaBuilder");
     if (search_value && component.searchField) {
-        query[`data.${component.searchField}__regex`] = `/${search_value}/i`;
+        query[`data.${component.searchField}__regex`] = `/${(0, utils_1.escapeSearchPattern)(search_value)}/i`;
     }
@@ -258,0 +259,0 @@ // Add component filter if configured (interpolate the filter string)

lib/tools/findSubmission.js

@@ -5,2 +5,3 @@ "use strict";
 const template_1 = require("../template");
+const utils_1 = require("./utils");
 const lodash_1 = require("lodash");
@@ -38,2 +39,16 @@ const SchemaBuilder_1 = require("./SchemaBuilder");
                     if (criterion.operator === 'regex') {
+                        // The value is a pattern by request here, so it is passed through
+                        // unescaped. It is still compiled first: the server drops a filter
+                        // it cannot compile, which would widen the search instead of
+                        // failing it, so a bad pattern is better reported back.
+                        try {
+                            new RegExp(criterion.search_value);
+                        }
+                        catch (err) {
+                            return project.mcpResponse(template_1.ResponseTemplate.submissionSearchError, {
+                                form: form.form,
+                                searchQuery: search_query,
+                                error: `"${criterion.search_value}" is not a valid regular expression for "${criterion.data_path}". Use the "contains" operator to search for it literally.`
+                            }, true);
+                        }
                         query[`data.${criterion.data_path}__regex`] = `/${criterion.search_value}/i`;
@@ -45,9 +60,9 @@ }
                     else if (criterion.operator === 'contains') {
-                        query[`data.${criterion.data_path}__regex`] = `/${criterion.search_value}/i`;
+                        query[`data.${criterion.data_path}__regex`] = `/${(0, utils_1.escapeSearchPattern)(criterion.search_value)}/i`;
                     }
                     else if (criterion.operator === 'starts_with') {
-                        query[`data.${criterion.data_path}__regex`] = `/^${criterion.search_value}/i`;
+                        query[`data.${criterion.data_path}__regex`] = `/^${(0, utils_1.escapeSearchPattern)(criterion.search_value)}/i`;
                     }
                     else if (criterion.operator === 'ends_with') {
-                        query[`data.${criterion.data_path}__regex`] = `/${criterion.search_value}$/i`;
+                        query[`data.${criterion.data_path}__regex`] = `/${(0, utils_1.escapeSearchPattern)(criterion.search_value)}$/i`;
                     }
@@ -54,0 +69,0 @@ else if (criterion.operator === 'greater_than') {

lib/tools/utils.d.ts

 import { ZodRawShape } from "zod";
+/**
+ * Escape a literal value so it can be carried in a `__regex` query parameter.
+ *
+ * Operators like "contains" promise a literal match, so every regular expression
+ * metacharacter in the value has to be neutered first. Left raw, a search for
+ * "[e-mail]" becomes a pattern whose dots match any character,
+ * and a value such as "[" is not a valid pattern at all — the server compiles
+ * these with a try/catch and silently drops the filter when compilation fails,
+ * which turns a narrow search into one that matches everything.
+ *
+ * Forward slashes get a further step. The server reads the parameter as
+ * `/pattern/flags` and takes the pattern with `[^/]+`, so an embedded slash
+ * truncates the pattern and the remainder is parsed as flags — again dropping
+ * the filter. Writing it as the equivalent `\x2f` escape keeps the character
+ * out of the transport while still matching a literal slash.
+ *
+ * @param value - The literal text to search for.
+ * @returns The value as a regular expression pattern that matches it literally.
+ */
+export declare const escapeSearchPattern: (value: string) => string;
 export type ToolInfo = {
@@ -3,0 +23,0 @@ name?: string;

lib/tools/utils.js

 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.escapeSearchPattern = void 0;
+const lodash_1 = require("lodash");
+/**
+ * Escape a literal value so it can be carried in a `__regex` query parameter.
+ *
+ * Operators like "contains" promise a literal match, so every regular expression
+ * metacharacter in the value has to be neutered first. Left raw, a search for
+ * "[e-mail]" becomes a pattern whose dots match any character,
+ * and a value such as "[" is not a valid pattern at all — the server compiles
+ * these with a try/catch and silently drops the filter when compilation fails,
+ * which turns a narrow search into one that matches everything.
+ *
+ * Forward slashes get a further step. The server reads the parameter as
+ * `/pattern/flags` and takes the pattern with `[^/]+`, so an embedded slash
+ * truncates the pattern and the remainder is parsed as flags — again dropping
+ * the filter. Writing it as the equivalent `\x2f` escape keeps the character
+ * out of the transport while still matching a literal slash.
+ *
+ * @param value - The literal text to search for.
+ * @returns The value as a regular expression pattern that matches it literally.
+ */
+const escapeSearchPattern = (value) => (0, lodash_1.escapeRegExp)(value).replace(/\//g, '\\x2f');
+exports.escapeSearchPattern = escapeSearchPattern;

package.json

 {
   "name": "@formio/uag",
-  "version": "1.12.1",
+  "version": "1.12.2",
   "mcpName": "io.form/uag",
@@ -33,3 +33,3 @@ "description": "The Form.io Universal Agent Gateway (UAG).",
   "dependencies": {
-    "@formio/appserver": "^2.13.1",
+    "@formio/appserver": "^2.13.2",
     "@formio/core": "2.8.0",
@@ -36,0 +36,0 @@ "@modelcontextprotocol/sdk": "1.30.0",

New alerts

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

Fixed alerts

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

Improved metrics

Total package byte prevSize

206037

1.78%

Lines of code

2728

2.21%

Dependency changes

• Updated

  @formio/appserver@^2.13.2