fix(utils): harden removeChars default char set#833
Conversation
Garfield-fr
commented
Jul 20, 2026
- Add "(", ")" and "" to the default removed chars, since they can break the query string structure built around user input
- Escape each char before building the RegExp, since "" was previously unsafe to pass in
- Keep other ES/Lucene operators (:, +, -, *) untouched by default
WalkthroughThe Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 ESLint
ESLint install timed out. The project may have too many dependencies for the sandbox. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@projects/rero/ng-core/src/lib/core/utils/utils.ts`:
- Around line 37-39: Update removeChars so its character escaping also escapes
hyphens before joining the escaped values into the RegExp character class,
ensuring custom sets remove only literal '-' characters. Add a regression test
covering a custom chars array containing '-' and verify range-like characters
remain unaffected.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 9deb1bde-0477-4ba2-85d5-06434f99959e
📒 Files selected for processing (2)
projects/rero/ng-core/src/lib/core/utils/utils.spec.tsprojects/rero/ng-core/src/lib/core/utils/utils.ts
* Add "(", ")" and "\" to the default removed
chars, since they can break the query string
structure built around user input
* Escape each char before building the RegExp,
since "\" was previously unsafe to pass in
* Keep other ES/Lucene operators (:, +, -, *)
untouched by default
Co-Authored-by: Bertrand Zuchuat <bertrand.zuchuat@rero.ch>
c876f1f to
3619642
Compare