Mask or replace special characters to prevent CQL injection

Overview:

Mask or replace the CQL special characters * ? ^

Steps to Reproduce:

1. Open the new order screen: https://folio-snapshot.dev.folio.org/orders/create 

2. Click Organization look-up

3. Use Search in "All" with one of these search strings:

   • a

   • a*

   • a?

   • a^

Expected Results:

Find records where a word beginning with a is in at least one of the searched fields.

Example result set:

• Alexander Street Press

• Amazon.com

• American Chemical Society

• Naxos of America, Inc.

A search using correct CQL is used.

Actual Results:

• a yields CQL ="a*", this is correct and returns the expected four results.

• a* yields CQL ="a**", this is wrong, the backend returns 400 with «org.folio.cql2pgjson.exception.QueryValidationException: * right truncation wildcard must be followed by space or end of string, but found *» and the front-end incorrectly shows «No results found for "a*". Please check your spelling and filters.»

• a? yields CQL ="a?*", this is wrong, the backend returns 400 with «org.folio.cql2pgjson.exception.QueryValidationException: ? wildcard not allowed in full text query string» and the front-end incorrectly shows «No results found for "a?". Please check your spelling and filters.»

• a^ yields CQL ="a^*", this is incorrect CQL because ^ is a special CQL character that is only allowed at the beginning of the search string. The backend is forgiving and returns the expected four results; this may change, though. Therefore the CQL should be fixed.

The = operator runs a full text word search: https://dev.folio.org/faqs/explain-cql/

In full text word search punctuation is ignored.

One way to fix this issue to replace each * ? ^ with a comma.

Additional Information:
See "masking" in CQL spec: https://www.loc.gov/standards/sru/cql/contextSets/theCqlContextSet.html

Interested parties: