fix(core): Unescaped regex in room files search#41571
Open
aegisforensicsmonk wants to merge 1 commit into
Open
fix(core): Unescaped regex in room files search#41571aegisforensicsmonk wants to merge 1 commit into
aegisforensicsmonk wants to merge 1 commit into
Conversation
Contributor
|
Looks like this PR is not ready to merge, because of the following issues:
Please fix the issues and try again If you have any trouble, please check the PR guidelines |
🦋 Changeset detectedLatest commit: 6144d40 The changes in this PR will be included in the next version bump. This PR includes changesets to release 3 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
|
Contributor
WalkthroughRoom file search now trims the ChangesRoom file search filtering
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches⚔️ Resolve merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@apps/meteor/app/api/server/v1/channels.ts`:
- Line 829: Normalize the search name before building the room-file filters so
whitespace-only input does not produce an empty regex. Update the name condition
and regex at apps/meteor/app/api/server/v1/channels.ts:829,
apps/meteor/app/api/server/v1/groups.ts:409, and
apps/meteor/app/api/server/v1/im.ts:480 to use the same non-empty trimmed value
consistently.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 2de0fc05-a549-4e67-b972-ca1c543efc0d
📒 Files selected for processing (4)
.changeset/fix-room-files-search-special-chars.mdapps/meteor/app/api/server/v1/channels.tsapps/meteor/app/api/server/v1/groups.tsapps/meteor/app/api/server/v1/im.ts
📜 Review details
⏰ Context from checks skipped due to timeout. (1)
- GitHub Check: cubic · AI code reviewer
🧰 Additional context used
📓 Path-based instructions (1)
**/*.{ts,tsx,js}
📄 CodeRabbit inference engine (.cursor/rules/playwright.mdc)
**/*.{ts,tsx,js}: Write concise, technical TypeScript/JavaScript with accurate typing in Playwright tests
Avoid code comments in the implementation
Files:
apps/meteor/app/api/server/v1/im.tsapps/meteor/app/api/server/v1/groups.tsapps/meteor/app/api/server/v1/channels.ts
🧠 Learnings (6)
📚 Learning: 2026-03-16T21:50:37.589Z
Learnt from: amitb0ra
Repo: RocketChat/Rocket.Chat PR: 39676
File: .changeset/migrate-users-register-openapi.md:3-3
Timestamp: 2026-03-16T21:50:37.589Z
Learning: For changes related to OpenAPI migrations in Rocket.Chat/OpenAPI, when removing endpoint types and validators from rocket.chat/rest-typings (e.g., UserRegisterParamsPOST, /v1/users.register) document this as a minor changeset (not breaking) per RocketChat/Rocket.Chat-Open-API#150 Rule 7. Note that the endpoint type is re-exposed via a module augmentation .d.ts in the consuming package (e.g., packages/web-ui-registration/src/users-register.d.ts). In reviews, ensure the changeset clearly states: this is a non-breaking change, the major version should not be bumped, and the changeset reflects a minor version bump. Do not treat this as a breaking change during OpenAPI migrations.
Applied to files:
.changeset/fix-room-files-search-special-chars.md
📚 Learning: 2026-02-23T17:53:06.802Z
Learnt from: ggazzo
Repo: RocketChat/Rocket.Chat PR: 35995
File: apps/meteor/app/api/server/v1/rooms.ts:1107-1112
Timestamp: 2026-02-23T17:53:06.802Z
Learning: During PR reviews that touch endpoint files under apps/meteor/app/api/server/v1, enforce strict scope: if a PR targets a specific endpoint (e.g., rooms.favorite), do not propose changes to unrelated endpoints (e.g., rooms.invite) unless maintainers explicitly request them. Focus feedback on the touched endpoint's behavior, API surface, and related tests; avoid broad cross-endpoint changes in the same PR unless requested.
Applied to files:
apps/meteor/app/api/server/v1/im.tsapps/meteor/app/api/server/v1/groups.tsapps/meteor/app/api/server/v1/channels.ts
📚 Learning: 2026-02-24T19:09:01.522Z
Learnt from: ahmed-n-abdeltwab
Repo: RocketChat/Rocket.Chat PR: 38974
File: apps/meteor/app/api/server/v1/im.ts:220-221
Timestamp: 2026-02-24T19:09:01.522Z
Learning: In Rocket.Chat OpenAPI migration PRs for endpoints under apps/meteor/app/api/server/v1, avoid introducing logic changes. Only perform scope-tight changes that preserve behavior; style-only cleanups (e.g., removing inline comments) may be deferred to follow-ups to keep the migration PR focused.
Applied to files:
apps/meteor/app/api/server/v1/im.tsapps/meteor/app/api/server/v1/groups.tsapps/meteor/app/api/server/v1/channels.ts
📚 Learning: 2026-02-26T19:25:44.063Z
Learnt from: gabriellsh
Repo: RocketChat/Rocket.Chat PR: 38778
File: packages/ui-voip/src/providers/useMediaSession.ts:192-192
Timestamp: 2026-02-26T19:25:44.063Z
Learning: In the Rocket.Chat repository, do not reference Biome lint rules in code review feedback. Biome is not used even if biome.json exists; only reference Biome rules if there is explicit, project-wide usage documented. For TypeScript files, review lint implications without Biome guidance unless the project enables Biome rules.
Applied to files:
apps/meteor/app/api/server/v1/im.tsapps/meteor/app/api/server/v1/groups.tsapps/meteor/app/api/server/v1/channels.ts
📚 Learning: 2026-02-26T19:25:44.063Z
Learnt from: gabriellsh
Repo: RocketChat/Rocket.Chat PR: 38778
File: packages/ui-voip/src/providers/useMediaSession.ts:192-192
Timestamp: 2026-02-26T19:25:44.063Z
Learning: In this repository (RocketChat/Rocket.Chat), Biome lint rules are not used even if a biome.json exists. When reviewing TypeScript files (e.g., packages/ui-voip/src/providers/useMediaSession.ts), ensure lint suggestions do not reference Biome-specific rules. Rely on general ESLint/TypeScript lint rules and project conventions instead.
Applied to files:
apps/meteor/app/api/server/v1/im.tsapps/meteor/app/api/server/v1/groups.tsapps/meteor/app/api/server/v1/channels.ts
📚 Learning: 2026-05-06T12:21:44.083Z
Learnt from: juliajforesti
Repo: RocketChat/Rocket.Chat PR: 40256
File: apps/meteor/client/components/CreateDiscussion/CreateDiscussion.tsx:121-149
Timestamp: 2026-05-06T12:21:44.083Z
Learning: Field wrappers in rocket.chat/fuselage-forms (Field, FieldLabel, FieldRow, FieldError, FieldHint) auto-create htmlFor/id associations, aria-describedby, and role="alert" for errors. Do not manually set htmlFor, id, aria-describedby, or role attributes when using these wrappers. This automatic wiring does not apply to plain rocket.chat/fuselage components, which require explicit ID wiring per the accessibility docs. In code reviews, prefer using fuselage-forms wrappers for form fields and verify there is no unnecessary manual ID/aria wiring in files that use these wrappers. If a component uses plain fuselage components, ensure proper id wiring as per docs.
Applied to files:
apps/meteor/app/api/server/v1/im.tsapps/meteor/app/api/server/v1/groups.tsapps/meteor/app/api/server/v1/channels.ts
🔇 Additional comments (4)
apps/meteor/app/api/server/v1/channels.ts (1)
2-2: LGTM!apps/meteor/app/api/server/v1/groups.ts (1)
2-2: LGTM!apps/meteor/app/api/server/v1/im.ts (1)
5-5: LGTM!.changeset/fix-room-files-search-special-chars.md (1)
1-5: LGTM!
| rid: findResult._id, | ||
| ...query, | ||
| ...(name ? { name: { $regex: name || '', $options: 'i' } } : {}), | ||
| ...(name ? { name: { $regex: escapeRegExp(name.trim()), $options: 'i' } } : {}), |
Contributor
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Handle whitespace-only search names consistently across all room file endpoints.
Each endpoint checks name before trimming it, so whitespace-only input becomes $regex: "" and matches every filename.
apps/meteor/app/api/server/v1/channels.ts#L829-L829: use a non-empty trimmed value for the condition and regex.apps/meteor/app/api/server/v1/groups.ts#L409-L409: apply the same normalized-name logic.apps/meteor/app/api/server/v1/im.ts#L480-L480: apply the same normalized-name logic.
📍 Affects 3 files
apps/meteor/app/api/server/v1/channels.ts#L829-L829(this comment)apps/meteor/app/api/server/v1/groups.ts#L409-L409apps/meteor/app/api/server/v1/im.ts#L480-L480
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@apps/meteor/app/api/server/v1/channels.ts` at line 829, Normalize the search
name before building the room-file filters so whitespace-only input does not
produce an empty regex. Update the name condition and regex at
apps/meteor/app/api/server/v1/channels.ts:829,
apps/meteor/app/api/server/v1/groups.ts:409, and
apps/meteor/app/api/server/v1/im.ts:480 to use the same non-empty trimmed value
consistently.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
2 issues found across 4 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="apps/meteor/app/api/server/v1/channels.ts">
<violation number="1" location="apps/meteor/app/api/server/v1/channels.ts:829">
P3: Whitespace-only name values trigger an empty regex that matches all files. If `name` is all whitespace (e.g. `" "`), `name` is truthy so the block executes, but `name.trim()` produces `""`, and `escapeRegExp("")` returns `""`. MongoDB `$regex: ""` matches every document — returning all files instead of filtering. The old code would have searched for the literal whitespace pattern (or skipped when name was falsy).</violation>
</file>
<file name="apps/meteor/app/api/server/v1/im.ts">
<violation number="1" location="apps/meteor/app/api/server/v1/im.ts:480">
P3: Whitespace-only `name` input (e.g., `" "`) passes the truthy guard but produces an empty regex after `.trim()`, which matches all files instead of meaningfully filtering. For `name = " "`, old code matched filenames with spaces; new code matches everything. Wrap the guard on the trimmed value to preserve intentional filtering for this edge case.</violation>
</file>
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
| rid: findResult._id, | ||
| ...query, | ||
| ...(name ? { name: { $regex: name || '', $options: 'i' } } : {}), | ||
| ...(name ? { name: { $regex: escapeRegExp(name.trim()), $options: 'i' } } : {}), |
Contributor
There was a problem hiding this comment.
P3: Whitespace-only name values trigger an empty regex that matches all files. If name is all whitespace (e.g. " "), name is truthy so the block executes, but name.trim() produces "", and escapeRegExp("") returns "". MongoDB $regex: "" matches every document — returning all files instead of filtering. The old code would have searched for the literal whitespace pattern (or skipped when name was falsy).
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At apps/meteor/app/api/server/v1/channels.ts, line 829:
<comment>Whitespace-only name values trigger an empty regex that matches all files. If `name` is all whitespace (e.g. `" "`), `name` is truthy so the block executes, but `name.trim()` produces `""`, and `escapeRegExp("")` returns `""`. MongoDB `$regex: ""` matches every document — returning all files instead of filtering. The old code would have searched for the literal whitespace pattern (or skipped when name was falsy).</comment>
<file context>
@@ -825,7 +826,7 @@ API.v1.addRoute(
rid: findResult._id,
...query,
- ...(name ? { name: { $regex: name || '', $options: 'i' } } : {}),
+ ...(name ? { name: { $regex: escapeRegExp(name.trim()), $options: 'i' } } : {}),
...(typeGroup ? { typeGroup } : {}),
...(onlyConfirmed && { expiresAt: { $exists: false } }),
</file context>
| ...query, | ||
| rid: room._id, | ||
| ...(name ? { name: { $regex: name || '', $options: 'i' } } : {}), | ||
| ...(name ? { name: { $regex: escapeRegExp(name.trim()), $options: 'i' } } : {}), |
Contributor
There was a problem hiding this comment.
P3: Whitespace-only name input (e.g., " ") passes the truthy guard but produces an empty regex after .trim(), which matches all files instead of meaningfully filtering. For name = " ", old code matched filenames with spaces; new code matches everything. Wrap the guard on the trimmed value to preserve intentional filtering for this edge case.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At apps/meteor/app/api/server/v1/im.ts, line 480:
<comment>Whitespace-only `name` input (e.g., `" "`) passes the truthy guard but produces an empty regex after `.trim()`, which matches all files instead of meaningfully filtering. For `name = " "`, old code matched filenames with spaces; new code matches everything. Wrap the guard on the trimmed value to preserve intentional filtering for this edge case.</comment>
<file context>
@@ -476,7 +477,7 @@ const dmFilesAction = <Path extends string>(_path: Path): TypedAction<typeof dmF
...query,
rid: room._id,
- ...(name ? { name: { $regex: name || '', $options: 'i' } } : {}),
+ ...(name ? { name: { $regex: escapeRegExp(name.trim()), $options: 'i' } } : {}),
...(typeGroup ? { typeGroup } : {}),
...(onlyConfirmed && { expiresAt: { $exists: false } }),
</file context>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proposed changes (including videos or screenshots)
Issue(s)
Steps to test or reproduce
Further comments
Summary by CodeRabbit