Problem
The search module (backend/src/search/) accepts free-text user input. There is no documented minimum length, maximum length, or sanitization on the query string, which allows single-character queries that scan the whole table and pathological inputs (thousand-character strings, %/_ LIKE wildcards) that degrade the database.
Requirements
- Add a
SearchQueryDto validating: trimmed non-empty string, min length 2, max length 100
- Escape SQL LIKE wildcards (
%, _) in the user input before it reaches any LIKE/ILIKE clause so they match literally
- Return 400 with a clear message for invalid queries; return an empty result set (not an error) for valid queries with no matches
- Normalize whitespace (collapse internal runs of spaces) before searching
- Unit tests: 1-char query rejected, 101-char query rejected,
"%" query matches literal percent only, whitespace-only query rejected
Acceptance Criteria
- No user input can inject LIKE wildcards or oversized scans into search SQL
- Validation errors are 400s with actionable messages
- All rules pinned by unit tests
Files
backend/src/search/ (controller, service, new DTO)
Problem
The search module (
backend/src/search/) accepts free-text user input. There is no documented minimum length, maximum length, or sanitization on the query string, which allows single-character queries that scan the whole table and pathological inputs (thousand-character strings,%/_LIKE wildcards) that degrade the database.Requirements
SearchQueryDtovalidating: trimmed non-empty string, min length 2, max length 100%,_) in the user input before it reaches any LIKE/ILIKE clause so they match literally"%"query matches literal percent only, whitespace-only query rejectedAcceptance Criteria
Files
backend/src/search/(controller, service, new DTO)