Lack of interest BB codes in search index

[Lukas W.]

I wasn't completely sure if I should post this as bug report or as suggestion, but I went with bug report for now, as it seems kinda broken to me. Please feel free to move it to suggestions and rename it to something more useful, if necessary.

When creating a search index item, XF doesn't run any pre-processing method on the search message that's being entered into the database. I assume it's that message that's being used to create the final search result listing item, so the BB code probably wants to stay in there, but it also allows to search for BB code structures, that might not be intended to be searched. Custom BB codes like a parsehtml or hide get stored into the search index without any real means of pre-processing, so we can't actually strip out content that we don't want to go there. As IndexRecord::create doesn't go through the class proxy for obvious reasons, we don't really have a way to intercept and apply our own sanitation.

 

[V3NTUS]

I agree with you, hope the xf team will look into it as it's very frustrating to have users cheat on my forum because of this reason. They already found this trick to see hidden content and they keep abusing it.

 

[Ignite]

I agree with @Lukas W.

- BuMpLaZors -

 

[Jeremy P]

I assume it's that message that's being used to create the final search result listing item

The actual entity is fetched for displaying results, so I'm not sure if it would matter if it was stripped from the index.

As IndexRecord::create doesn't go through the class proxy for obvious reasons, we don't really have a way to intercept and apply our own sanitation.

A bit tedious if you're dealing with a bunch of content types (and impractical if you have to worry about 3rd party content types), but you can extend search handlers to modify the index record.

 

[Lukas W.]

The actual entity is fetched for displaying results, so I'm not sure if it would matter if it was stripped from the index.

I have the rendered version adjustes to not include the content of my hide BB codes, but apparently you can "guess" the content by searching for it and having the respective post show up as search result as an indicator you searched for the right thing. Complicated, I know, but people do more for less.

 

[Lukas W.]

A bit tedious if you're dealing with a bunch of content types (and impractical if you have to worry about 3rd party content types), but you can extend search handlers to modify the index record.

Yeah, I basically have to worry about all content types that support bb codes, so that's not a feasible solution

 

[Xon]

Yeah, I basically have to worry about all content types that support bb codes, so that's not a feasible solution

You can extend the search provider and filter on ingress (\XF\Search\Source\AbstractSource::Index) for each source handler (MySQL or ElasticSearch).

Alternatively you could extend XF\Search\Search class and shim the handler method to return a wrapper class for any search provider returned. Or dynamically shim the returned handler so the class parent is preserved.