client: escape periods in tag names

Merges PR #390

7 files changed, 11 insertions, 10 deletions

diff --git a/client/js/controllers/pool_controller.js b/client/js/controllers/pool_controller.js
index 6844171..ad0b956 100644
--- a/client/js/controllers/pool_controller.js
+++ b/client/js/controllers/pool_controller.js
@@ -52,7 +52,7 @@ class PoolController {
                     canMerge: api.hasPrivilege("pools:merge"),
                     canDelete: api.hasPrivilege("pools:delete"),
                     categories: categories,
-                    escapeColons: uri.escapeColons,
+                    escapeTagName: uri.escapeTagName,
                 });
 
                 this._view.addEventListener("change", (e) =>
diff --git a/client/js/controllers/pool_create_controller.js b/client/js/controllers/pool_create_controller.js
index 7140aac..3ae3721 100644
--- a/client/js/controllers/pool_create_controller.js
+++ b/client/js/controllers/pool_create_controller.js
@@ -26,7 +26,7 @@ class PoolCreateController {
                 this._view = new PoolCreateView({
                     canCreate: api.hasPrivilege("pools:create"),
                     categories: categories,
-                    escapeColons: uri.escapeColons,
+                    escapeTagName: uri.escapeTagName,
                 });
 
                 this._view.addEventListener("submit", (e) =>
diff --git a/client/js/controllers/tag_controller.js b/client/js/controllers/tag_controller.js
index 0928b3f..dfd80bc 100644
--- a/client/js/controllers/tag_controller.js
+++ b/client/js/controllers/tag_controller.js
@@ -56,7 +56,7 @@ class TagController {
                     canMerge: api.hasPrivilege("tags:merge"),
                     canDelete: api.hasPrivilege("tags:delete"),
                     categories: categories,
-                    escapeColons: uri.escapeColons,
+                    escapeTagName: uri.escapeTagName,
                 });
 
                 this._view.addEventListener("change", (e) =>
diff --git a/client/js/controls/post_readonly_sidebar_control.js b/client/js/controls/post_readonly_sidebar_control.js
index 9bc767f..d11fa92 100644
--- a/client/js/controls/post_readonly_sidebar_control.js
+++ b/client/js/controls/post_readonly_sidebar_control.js
@@ -28,7 +28,7 @@ class PostReadonlySidebarControl extends events.EventTarget {
                 canListPosts: api.hasPrivilege("posts:list"),
                 canEditPosts: api.hasPrivilege("posts:edit"),
                 canViewTags: api.hasPrivilege("tags:view"),
-                escapeColons: uri.escapeColons,
+                escapeTagName: uri.escapeTagName,
                 extractRootDomain: uri.extractRootDomain,
                 getPrettyName: misc.getPrettyName,
             })
diff --git a/client/js/controls/tag_input_control.js b/client/js/controls/tag_input_control.js
index 7d069f9..1ac1cb3 100644
--- a/client/js/controls/tag_input_control.js
+++ b/client/js/controls/tag_input_control.js
@@ -163,7 +163,8 @@ class TagInputControl extends events.EventTarget {
 
     addTagByName(name, source) {
         name = name.trim();
-        if (!name) {
+        // Tags `.` and `..` are not allowed, see https://github.com/rr-/szurubooru/pull/390
+        if (!name || name == "." || name == "..") {
             return;
         }
         return Tag.get(name).then(
@@ -305,7 +306,7 @@ class TagInputControl extends events.EventTarget {
         searchLinkNode.setAttribute(
             "href",
             uri.formatClientLink("posts", {
-                query: uri.escapeColons(tag.names[0]),
+                query: uri.escapeTagName(tag.names[0]),
             })
         );
         searchLinkNode.textContent = tag.names[0] + " ";
diff --git a/client/js/util/misc.js b/client/js/util/misc.js
index 4f9d6d3..756ad84 100644
--- a/client/js/util/misc.js
+++ b/client/js/util/misc.js
@@ -187,7 +187,7 @@ function arraysDiffer(source1, source2, orderImportant) {
 }
 
 function escapeSearchTerm(text) {
-    return text.replace(/([a-z_-]):/g, "$1\\:");
+    return text.replace(/([a-z_-]):/g, "$1\\:").replace(/\./g, "\\.");
 }
 
 function dataURItoBlob(dataURI) {
diff --git a/client/js/util/uri.js b/client/js/util/uri.js
index 16fa4f8..8064cdb 100644
--- a/client/js/util/uri.js
+++ b/client/js/util/uri.js
@@ -85,14 +85,14 @@ function extractRootDomain(url) {
     return domain;
 }
 
-function escapeColons(text) {
-    return text.replace(new RegExp(":", "g"), "\\:");
+function escapeTagName(text) {
+    return text.replace(/:/g, "\\:").replace(/\./g, "\\.");
 }
 
 module.exports = {
     formatClientLink: formatClientLink,
     formatApiLink: formatApiLink,
-    escapeColons: escapeColons,
+    escapeTagName: escapeTagName,
     escapeParam: escapeParam,
     unescapeParam: unescapeParam,
     extractHostname: extractHostname,