Skip to content

fix(api): refactors the SQL LIKE pattern escaping logic to use a centralized utility function, ensuring consistent and secure handling of special characters across all database queries.#12

Open
tomerqodo wants to merge 4 commits intosentry_full_base_fixapi_refactors_the_sql_like_pattern_escaping_logic_to_use_a_centralized__utility_function_ensuring_consistent_and_secure_handling_of_special_characters_across_all_database_queries_pfrom
sentry_full_head_fixapi_refactors_the_sql_like_pattern_escaping_logic_to_use_a_centralized__utility_function_ensuring_consistent_and_secure_handling_of_special_characters_across_all_database_queries_p
Open

fix(api): refactors the SQL LIKE pattern escaping logic to use a centralized utility function, ensuring consistent and secure handling of special characters across all database queries.#12
tomerqodo wants to merge 4 commits intosentry_full_base_fixapi_refactors_the_sql_like_pattern_escaping_logic_to_use_a_centralized__utility_function_ensuring_consistent_and_secure_handling_of_special_characters_across_all_database_queries_pfrom
sentry_full_head_fixapi_refactors_the_sql_like_pattern_escaping_logic_to_use_a_centralized__utility_function_ensuring_consistent_and_secure_handling_of_special_characters_across_all_database_queries_p

Conversation

@tomerqodo
Copy link
Copy Markdown

Benchmark PR from agentic-review-benchmarks#12

NeatGuyCoding and others added 4 commits January 25, 2026 12:05
…ralized

utility function, ensuring consistent and secure handling of special characters
across all database queries.

Signed-off-by: NeatGuyCoding <15627489+NeatGuyCoding@users.noreply.github.com>
…logic

Signed-off-by: NeatGuyCoding <15627489+NeatGuyCoding@users.noreply.github.com>
case "not contains":
filters.append(json_field.notlike(f"%{value}%"))
escaped_value = escape_like_pattern(str(value))
filters.append(json_field.notlike(f"%{escaped_value}%"))
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: The notlike() filter for metadata is missing the escape="\\" parameter, causing incorrect results when searching for values containing special characters like % or _.
Severity: MEDIUM

Suggested Fix

Add the escape="\\" parameter to the notlike() method call on line 1207 to ensure that special characters in the search value are correctly handled, consistent with other LIKE-based filters in the function.

Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: api/core/rag/retrieval/dataset_retrieval.py#L1207

Potential issue: The "not contains" metadata filter at
`api/core/rag/retrieval/dataset_retrieval.py:1207` uses `notlike()` without the
necessary `escape="\\"` parameter. While other similar filters in the same function
correctly include this parameter to handle special characters, its omission here will
cause incorrect filtering behavior. When a user performs a "not contains" search for a
value that includes a special SQL character like `%` or `_`, the filter will fail to
correctly interpret the escaped value. For example, a search to exclude records
containing "50%" would not work as intended, leading to incorrect query results.

Did we get this right? 👍 / 👎 to inform future reviews.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants