fix(security): escape LIKE pattern wildcards in admin user search and courses (#533)

src/modules/admin/admin-users.service.ts

@@ -9,6 +9,7 @@ import {
   auditLogs,
 } from "../../database/schema.js";
 import { NotFoundError, ValidationError } from "../../utils/errors.js";
+import { escapeLikePattern } from "../../utils/sanitize.js";
 import { auditLog } from "../../audit/index.js";
 import { logger } from "../../utils/logger.js";
 import {
@@ -37,8 +38,8 @@ export class AdminUsersService {
     const conditions = search
       ? [
           or(
-            ilike(users.stellarAddress, `%${search}%`),
-            ilike(users.displayName, `%${search}%`),
+            ilike(users.stellarAddress, `%${escapeLikePattern(search)}%`),
+            ilike(users.displayName, `%${escapeLikePattern(search)}%`),
           )!,
         ]
       : [];

src/modules/courses/course.service.ts

@@ -33,6 +33,7 @@ import { PASSING_PERCENTAGE } from "../quizzes/quiz.types.js";
 import { auditLog } from "../../audit/index.js";
 import { dispatchWebhook } from "../../services/webhook-dispatcher.js";
 import { waitlistService } from "./waitlist.service.js";
+import { escapeLikePattern } from "../../utils/sanitize.js";
 import {
   cacheGet,
   cacheSet,
@@ -209,7 +210,7 @@ export class CourseService {
         conditions.push(eq(courses.difficulty, query.difficulty));
       }
       if (search) {
-        const escaped = search.replace(/[%_]/g, "\\$&");
+        const escaped = escapeLikePattern(search);
         conditions.push(
           or(
             ilike(courses.title, `%${escaped}%`),

src/utils/sanitize.ts

@@ -20,3 +20,11 @@ export function sanitizeText(input: string): string {
 export function sanitizeQuizFeedback(input: string): string {
   return sanitizeHtml(input, STRICT_OPTIONS);
 }
+
+/**
+ * Escape special LIKE pattern characters (%, _, and \) with backslashes
+ * to prevent wildcard injection in SQL/ORM queries (#533).
+ */
+export function escapeLikePattern(pattern: string): string {
+  return pattern.replace(/[%_\\]/g, "\\$&");
+}

tests/unit/utils/sanitize.test.ts

@@ -2,6 +2,7 @@ import { describe, it, expect } from "vitest";
 import {
   sanitizeText,
   sanitizeQuizFeedback,
+  escapeLikePattern,
 } from "../../../src/utils/sanitize.js";
 
 describe("sanitizeText", () => {
@@ -36,3 +37,28 @@ describe("sanitizeQuizFeedback", () => {
     expect(out).toContain("Correct!");
   });
 });
+
+describe("escapeLikePattern (#533)", () => {
+  it("escapes percent wildcards", () => {
+    expect(escapeLikePattern("100%")).toBe("100\\%");
+    expect(escapeLikePattern("%admin%")).toBe("\\%admin\\%");
+  });
+
+  it("escapes underscore wildcards", () => {
+    expect(escapeLikePattern("user_name")).toBe("user\\_name");
+    expect(escapeLikePattern("___")).toBe("\\_\\_\\_");
+  });
+
+  it("escapes backslashes", () => {
+    expect(escapeLikePattern("path\\to")).toBe("path\\\\to");
+  });
+
+  it("handles mixed special characters", () => {
+    expect(escapeLikePattern("50%_discount\\deal")).toBe("50\\%\\_discount\\\\deal");
+  });
+
+  it("leaves standard alphanumeric strings unchanged", () => {
+    expect(escapeLikePattern("GBZX...123 Stellar")).toBe("GBZX...123 Stellar");
+    expect(escapeLikePattern("")).toBe("");
+  });
+});