[11.x] Escape values in Meilisearch whereIn and whereNotIn filters

Merged
XU
15d ago
+34-2

#958 fixed quote escaping for where(), but whereIn() and whereNotIn() were missed, so their values still go into the filter unescaped.

Because of this, a value with a " in it breaks the search. For example, whereIn('size', ['12" pipe']) throws an invalid_search_filter error.

It can also change the filter itself. If a value like x"] OR team_id = 2 OR category IN ["y comes from user input, the filter becomes:

team_id=1 AND category IN ["x"] OR team_id = 2 OR category IN ["y"]

and returns records the user shouldn't see.

This escapes the values the same way #958 does for where().