diff --git a/source/java/org/alfresco/rest/api/impl/QueriesImpl.java b/source/java/org/alfresco/rest/api/impl/QueriesImpl.java index 5b751f5bee..118f76be80 100644 --- a/source/java/org/alfresco/rest/api/impl/QueriesImpl.java +++ b/source/java/org/alfresco/rest/api/impl/QueriesImpl.java @@ -66,6 +66,9 @@ public class QueriesImpl implements Queries, InitializingBean private final static String QUERY_LIVE_SEARCH_NODES = "live-search-nodes"; + private final static int TERM_MIN_LEN = 3; // review: should this be configurable system-wide (&/or per-tenant in the cloud) ? + + private final static Map MAP_PARAM_SORT_QNAME; static { @@ -112,12 +115,33 @@ public class QueriesImpl implements Queries, InitializingBean StringBuilder sb = new StringBuilder(); - // TODO check min length, excluding quotes etc String term = parameters.getParameter(PARAM_TERM); if (term == null) { throw new InvalidArgumentException("Query 'term' not specified"); } + else + { + String s = term.trim(); + int cnt = 0; + for (int i = 0; i < s.length(); i++) + { + char c = s.charAt(i); + if (Character.isLetterOrDigit(c)) + { + cnt++; + if (cnt == TERM_MIN_LEN) + { + break; + } + } + } + + if (cnt < TERM_MIN_LEN) + { + throw new InvalidArgumentException("Query 'term' is too short. Must have at least "+TERM_MIN_LEN+" alphanumeric chars"); + } + } String rootNodeId = parameters.getParameter(PARAM_ROOT_NODE_ID); if (rootNodeId != null) diff --git a/source/test-java/org/alfresco/rest/api/tests/QueriesApiTest.java b/source/test-java/org/alfresco/rest/api/tests/QueriesApiTest.java index f5ccd631f7..a6310bb5a7 100644 --- a/source/test-java/org/alfresco/rest/api/tests/QueriesApiTest.java +++ b/source/test-java/org/alfresco/rest/api/tests/QueriesApiTest.java @@ -393,6 +393,16 @@ public class QueriesApiTest extends AbstractBaseApiTest params.put(Queries.PARAM_ROOT_NODE_ID, myFolderNodeId); getAll(URL_QUERIES_LSN, user1, paging, params, 400); + // -ve test - term too short + params = new HashMap<>(1); + params.put(Queries.PARAM_TERM, "ab"); + getAll(URL_QUERIES_LSN, user1, paging, params, 400); + + // -ve test - term is still too short + params = new HashMap<>(1); + params.put(Queries.PARAM_TERM, " \"a b *\" "); + getAll(URL_QUERIES_LSN, user1, paging, params, 400); + // -ve test - invalid sort field params = new HashMap<>(2); params.put(Queries.PARAM_TERM, testTerm);