Fix #142 - Escape ILIKE special characters from Account.find_remote

diff --git a/app/models/account.rb b/app/models/account.rb
index 47de161d8c7ff1d74b0cad43aac67cde268bb259..81b724935073641270f677354cc3b0dba277e932 100644 (file)
--- a/app/models/account.rb
+++ b/app/models/account.rb
@@ -142,7 +142,7 @@ class Account < ApplicationRecord
     end
 
     def find_remote!(username, domain)
-      where(arel_table[:username].matches(username)).where(domain.nil? ? { domain: nil } : arel_table[:domain].matches(domain)).take!
+      where(arel_table[:username].matches(username.gsub(/[%_]/, '\\\\\0'))).where(domain.nil? ? { domain: nil } : arel_table[:domain].matches(domain.gsub(/[%_]/, '\\\\\0'))).take!
     end
 
     def find_local(username)

diff --git a/spec/models/account_spec.rb b/spec/models/account_spec.rb
index 0939ecdd01aa7f4fc872db0f08b65f1267140890..a72369b1c0ebbff903a8d6e76ada01148effe1d0 100644 (file)
--- a/spec/models/account_spec.rb
+++ b/spec/models/account_spec.rb
@@ -107,11 +107,51 @@ RSpec.describe Account, type: :model do
   end
 
   describe '.find_local' do
-    pending
+    before do
+      Fabricate(:account, username: 'Alice')
+    end
+
+    it 'returns Alice for alice' do
+      expect(Account.find_local('alice')).to_not be_nil
+    end
+
+    it 'returns Alice for Alice' do
+      expect(Account.find_local('Alice')).to_not be_nil
+    end
+
+    it 'does not return anything for a_ice' do
+      expect(Account.find_local('a_ice')).to be_nil
+    end
+
+    it 'does not return anything for al%' do
+      expect(Account.find_local('al%')).to be_nil
+    end
   end
 
   describe '.find_remote' do
-    pending
+    before do
+      Fabricate(:account, username: 'Alice', domain: 'mastodon.social')
+    end
+
+    it 'returns Alice for alice@mastodon.social' do
+      expect(Account.find_remote('alice', 'mastodon.social')).to_not be_nil
+    end
+
+    it 'returns Alice for ALICE@MASTODON.SOCIAL' do
+      expect(Account.find_remote('ALICE', 'MASTODON.SOCIAL')).to_not be_nil
+    end
+
+    it 'does not return anything for a_ice@mastodon.social' do
+      expect(Account.find_remote('a_ice', 'mastodon.social')).to be_nil
+    end
+
+    it 'does not return anything for alice@m_stodon.social' do
+      expect(Account.find_remote('alice', 'm_stodon.social')).to be_nil
+    end
+
+    it 'does not return anything for alice@m%' do
+      expect(Account.find_remote('alice', 'm%')).to be_nil
+    end
   end
 
   describe 'MENTION_RE' do