Bug 40907 - parenthesis and bracket are breaking filter on item table
Summary: parenthesis and bracket are breaking filter on item table
Status: Pushed to oldstable
Alias: None
Product: Koha
Classification: Unclassified
Component: Staff interface (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal
Assignee: Jonathan Druart
QA Contact: Nick Clemens (kidclamp)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-09-30 12:33 UTC by Mathieu Saby
Modified: 2025-11-10 15:19 UTC (History)
5 users (show)

See Also:
GIT URL:
Initiative type: ---
Sponsorship status: ---
Comma delimited list of Sponsors:
Crowdfunding goal: 0
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
25.11.00,25.05.05,24.11.11
Circulation function:


Attachments
Bug 40907: Add a Cypress test (1.29 KB, patch)
2025-10-07 12:54 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 40907: Prevent DT crash when searching with regex metachars (1.98 KB, patch)
2025-10-07 12:54 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 40907: Prevent DT crash when searching with regex metachars (2.02 KB, patch)
2025-10-07 15:49 UTC, Biblibre Sandboxes
Details | Diff | Splinter Review
Bug 40907: Add a Cypress test (1.33 KB, patch)
2025-10-07 15:50 UTC, Biblibre Sandboxes
Details | Diff | Splinter Review
Bug 40907: Prevent DT crash when searching with regex metachars (2.02 KB, patch)
2025-10-07 15:50 UTC, Biblibre Sandboxes
Details | Diff | Splinter Review
Bug 40907: Add a Cypress test (1.38 KB, patch)
2025-10-08 19:55 UTC, Brendan Lawlor
Details | Diff | Splinter Review
Bug 40907: Prevent DT crash when searching with regex metachars (2.08 KB, patch)
2025-10-08 19:55 UTC, Brendan Lawlor
Details | Diff | Splinter Review
Bug 40907: Add a Cypress test (1.44 KB, patch)
2025-10-16 17:48 UTC, Nick Clemens (kidclamp)
Details | Diff | Splinter Review
Bug 40907: Prevent DT crash when searching with regex metachars (2.13 KB, patch)
2025-10-16 17:48 UTC, Nick Clemens (kidclamp)
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Mathieu Saby 2025-09-30 12:33:09 UTC
The general filter above the item table in /catalogue/detail.pl breaks if you try to search something begining with ( or [

The "processing" popup never fades.

The console displays: 

Uncaught SyntaxError: Invalid regular expression: /^(/i: Unterminated group (at datatables_25.0600018.js:556:47)
Comment 1 Arthur Suzuki 2025-10-07 09:03:55 UTC
Actually I'm not sure this should be considered as a bug.
DataTable actually support regular expression for filtering the values.
For example, for a record I've set 3 items, 1 fiction, 1 non-fiction, and 1 "reference".

I can have both "fiction" and "non-fiction" to appear by using this string in the search input of the table :
".*(iction)"

Knowing this I'm not sure we can say parenthesis "breaks" the filter.
However I was not able to properly escape the parenthesis or brackets

https://www.threesl.com/blog/special-characters-regular-expressions-escape/
Comment 2 Jonathan Druart 2025-10-07 12:54:57 UTC
Created attachment 187523 [details] [review]
Bug 40907: Add a Cypress test
Comment 3 Jonathan Druart 2025-10-07 12:54:59 UTC
Created attachment 187524 [details] [review]
Bug 40907: Prevent DT crash when searching with regex metachars

We should remove the regex metacharacters from the string or JS code
will raise an error and the query won't be generated, leading to the DT
neverending loading problem.

Test plan:
Go to http://localhost:8081/cgi-bin/koha/catalogue/detail.pl?biblionumber=4
In the global "Search" of the items table, search using a regex
metacharacters in order to form a broken regex (eg. '[')
=> Without this patch there is a JS error in the console "Uncaught
SyntaxError: unterminated character class" and you get the "Processing"
that never ends
=> With this patch applied the search succeeds.
Comment 4 Mathieu Saby 2025-10-07 15:05:39 UTC
It is not known by librarian that we should use regex syntax here, so we consider the present behavior as a bug ;-)
Comment 5 Biblibre Sandboxes 2025-10-07 15:49:40 UTC
Created attachment 187534 [details] [review]
Bug 40907: Prevent DT crash when searching with regex metachars

We should remove the regex metacharacters from the string or JS code
will raise an error and the query won't be generated, leading to the DT
neverending loading problem.

Test plan:
Go to http://localhost:8081/cgi-bin/koha/catalogue/detail.pl?biblionumber=4
In the global "Search" of the items table, search using a regex
metacharacters in order to form a broken regex (eg. '[')
=> Without this patch there is a JS error in the console "Uncaught
SyntaxError: unterminated character class" and you get the "Processing"
that never ends
=> With this patch applied the search succeeds.

Signed-off-by: Mathieu <mathsabypro@gmail.com>
Comment 6 Biblibre Sandboxes 2025-10-07 15:50:44 UTC
Created attachment 187535 [details] [review]
Bug 40907: Add a Cypress test

Signed-off-by: Mathieu <mathsabypro@gmail.com>
Comment 7 Biblibre Sandboxes 2025-10-07 15:50:46 UTC
Created attachment 187536 [details] [review]
Bug 40907: Prevent DT crash when searching with regex metachars

We should remove the regex metacharacters from the string or JS code
will raise an error and the query won't be generated, leading to the DT
neverending loading problem.

Test plan:
Go to http://localhost:8081/cgi-bin/koha/catalogue/detail.pl?biblionumber=4
In the global "Search" of the items table, search using a regex
metacharacters in order to form a broken regex (eg. '[')
=> Without this patch there is a JS error in the console "Uncaught
SyntaxError: unterminated character class" and you get the "Processing"
that never ends
=> With this patch applied the search succeeds.

Signed-off-by: Mathieu <mathsabypro@gmail.com>
Comment 8 Mathieu Saby 2025-10-07 15:51:52 UTC
Thank you Jonathan. 
I tested on a sandbox : no more error in the console, and I was able to find callnumber such as "[a" or "(a"
Comment 9 Brendan Lawlor 2025-10-08 19:55:37 UTC
Created attachment 187599 [details] [review]
Bug 40907: Add a Cypress test

Signed-off-by: Mathieu <mathsabypro@gmail.com>
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Comment 10 Brendan Lawlor 2025-10-08 19:55:40 UTC
Created attachment 187600 [details] [review]
Bug 40907: Prevent DT crash when searching with regex metachars

We should remove the regex metacharacters from the string or JS code
will raise an error and the query won't be generated, leading to the DT
neverending loading problem.

Test plan:
Go to http://localhost:8081/cgi-bin/koha/catalogue/detail.pl?biblionumber=4
In the global "Search" of the items table, search using a regex
metacharacters in order to form a broken regex (eg. '[')
=> Without this patch there is a JS error in the console "Uncaught
SyntaxError: unterminated character class" and you get the "Processing"
that never ends
=> With this patch applied the search succeeds.

Signed-off-by: Mathieu <mathsabypro@gmail.com>
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Comment 11 Nick Clemens (kidclamp) 2025-10-16 17:48:41 UTC
Created attachment 188022 [details] [review]
Bug 40907: Add a Cypress test

Signed-off-by: Mathieu <mathsabypro@gmail.com>
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 12 Nick Clemens (kidclamp) 2025-10-16 17:48:44 UTC
Created attachment 188023 [details] [review]
Bug 40907: Prevent DT crash when searching with regex metachars

We should remove the regex metacharacters from the string or JS code
will raise an error and the query won't be generated, leading to the DT
neverending loading problem.

Test plan:
Go to http://localhost:8081/cgi-bin/koha/catalogue/detail.pl?biblionumber=4
In the global "Search" of the items table, search using a regex
metacharacters in order to form a broken regex (eg. '[')
=> Without this patch there is a JS error in the console "Uncaught
SyntaxError: unterminated character class" and you get the "Processing"
that never ends
=> With this patch applied the search succeeds.

Signed-off-by: Mathieu <mathsabypro@gmail.com>
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 13 Lucas Gass (lukeg) 2025-10-20 16:14:23 UTC
Nice work everyone!

Pushed to main for 25.11
Comment 14 Paul Derscheid 2025-10-29 09:09:59 UTC
Nice work everyone!

Pushed to 25.05.x
Comment 15 Fridolin Somers 2025-11-10 15:19:39 UTC
Pushed to 24.11.x for 24.11.11