Adding more validation for fuzzy queries (#7154)

* adding negative values check for fuzziness Signed-off-by: Sean Li <[email protected]> * addressing comment Signed-off-by: Sean Li <[email protected]> * addressing comment part 2 Signed-off-by: Sean Li <[email protected]> --------- Signed-off-by: Sean Li <[email protected]>
opensearch-project · Apr 18, 2023 · 10ab178 · 10ab178
1 parent eb8f8db
commit 10ab178
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 1 deletion.
diff --git a/server/src/main/java/org/opensearch/common/unit/Fuzziness.java b/server/src/main/java/org/opensearch/common/unit/Fuzziness.java
@@ -178,6 +178,9 @@ public static Fuzziness parse(XContentParser parser) throws IOException {
                 }
                 try {
                     final int minimumSimilarity = Integer.parseInt(fuzziness);
+                    if (minimumSimilarity < 0) {
+                        throw new IllegalArgumentException("Invalid fuzziness value: " + fuzziness);
+                    }
                     switch (minimumSimilarity) {
                         case 0:
                             return ZERO;
@@ -192,6 +195,9 @@ public static Fuzziness parse(XContentParser parser) throws IOException {
                     // Validate if the fuzziness value is formatted correctly as a numeric value.
                     try {
                         final float minimumSimilarity = Float.parseFloat(fuzziness);
+                        if (minimumSimilarity < 0.0f || Float.isInfinite(minimumSimilarity) || Float.isNaN(minimumSimilarity)) {
+                            throw new IllegalArgumentException("Invalid fuzziness value: " + fuzziness);
+                        }
                         return build(fuzziness);
                     } catch (NumberFormatException e) {
                         throw new IllegalArgumentException("Invalid fuzziness value: " + fuzziness);

diff --git a/server/src/test/java/org/opensearch/common/unit/FuzzinessTests.java b/server/src/test/java/org/opensearch/common/unit/FuzzinessTests.java
@@ -140,7 +140,7 @@ public void testParseFromXContent() throws IOException {
     }
 
     public void testFuzzinessValidationWithStrings() throws IOException {
-        String[] invalidStrings = new String[] { "+++", "asdfghjkl", "2k23" };
+        String[] invalidStrings = new String[] { "+++", "asdfghjkl", "2k23", "-1.0", "-100" };
         XContentBuilder json = jsonBuilder().startObject().field(Fuzziness.X_FIELD_NAME, randomFrom(invalidStrings)).endObject();
         try (XContentParser parser = createParser(json)) {
             assertThat(parser.nextToken(), equalTo(XContentParser.Token.START_OBJECT));