add search char validation

controller/helper.go

@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"io"
 	"net/http"
+	"regexp"
 	"strconv"
 	"strings"
 
@@ -44,7 +45,10 @@ func getSort(def string, r *http.Request) map[string]int64 {
 	return sort
 }
 
+var regexNonAlnumBlankPunct = regexp.MustCompile(`[^[:alnum:][:blank:][:punct:]]`)
 
+func isAlnumBlankPunct(s string) bool {
+	return !regexNonAlnumBlankPunct.MatchString(s)
 }
 
 func handleError(err error, w http.ResponseWriter) {

controller/item.go

@@ -29,6 +29,12 @@ func ItemIndexGET(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
 			return
 		}
 
+		if !isAlnumBlankPunct(txt) {
+			s := &Status{}
+			s.BadRequest("Query string contains invalid characters").Render(w)
+			return
+		}
+
 		opts := &item.Options{}
 		opts.Limit, opts.Offset = getLimitOffset(r)
 
@@ -136,6 +142,12 @@ Loop:
 				return
 			}
 
+			if !isAlnumBlankPunct(txt) {
+				s := &Status{}
+				s.BadRequest("Query string contains invalid characters").Render(w)
+				return
+			}
+
 			result, err = item.GetByText(txt, opts, kind)
 			if err != nil {
 				handleError(err, w)