Repository navigation
Fix backend search query hardening, deterministic ranking, flag cache TTL, and rollout stability - #2071
Merged
Olowodarey merged 1 commit intoOct 20, 2026
Conversation
…he TTL, and stable rollout bucketing - Search Query Injection Hardening (Arena1X#1953): - Neutralize search query operators and escape SQL LIKE wildcards (\, %, _) - Safely handle empty and whitespace-only queries in search(), searchCreatorEvents(), and fuzzySearch() - Preserve legitimate search query behavior for normal terms - Search Result Relevance Ranking Determinism (Arena1X#1954): - Add deterministic secondary sorting by entity title/username and id for equal-relevance results across markets, users, competitions, fuzzy search, and suggestions - Ensure repeated identical queries over unchanged data return identical ordering while maintaining relevance hierarchy - Feature Flag Evaluation Cache TTL & Invalidation (Arena1X#1955): - Bound cached flag evaluations to a documented 60-second TTL - Automatically invalidate evaluation cache entries on flag update and deletion - Ensure cache miss falls back to fresh evaluation - Feature Flag Percentage Rollout Bucketing Stability (Arena1X#1956): - Implement deterministic SHA-256 bucketing across flag key and user ID - Guarantee stable and monotonic rollout evaluations (0% includes nobody, 100% includes everyone, higher percentages strictly preserve existing users) Closes Arena1X#1953, Closes Arena1X#1954, Closes Arena1X#1955, Closes Arena1X#1956
|
@ScriptedBro Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This branch had an error being deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This pull request addresses and fixes four backend issues across search services and feature flag management:
Search Query Injection Hardening ([Backend] — Search Query Injection Hardening #1953):
sanitizeSearchInputto strip/neutralize query operators (&,|,!,:,*,<,>,",',\) that could manipulate full-text search structure or cause malformed tsquery errors.escapeLikeWildcardsto escape backslashes (\) before%and_with explicitESCAPE '\\'clauses on LIKE/ILIKE statements across search suggestions and typeahead.search(),fuzzySearch(), andsearchCreatorEvents()to handle empty or whitespace-only queries safely without executing unneeded or invalid database queries.Search Result Relevance Ranking Determinism ([Backend] — Search Result Relevance Ranking Determinism #1954):
created_at DESC,id ASC) tosearchCreatorEvents.Feature Flag Evaluation Cache TTL & Invalidation ([Backend] — Feature Flag Evaluation Cache TTL #1955):
FlagEvaluationCacheServiceto a documented default TTL (DEFAULT_FLAG_EVALUATION_CACHE_TTL_MS = 60,000ms).invalidate(flagKey)) inFeatureFlagsServicewhen feature flags are updated or deleted so changes reflect immediately.Feature Flag Percentage Rollout Bucketing Stability ([Backend] — Feature Flag Percentage Rollout Bucketing Stability #1956):
calculateRolloutBucket,isUserInRollout) using SHA-256 hash of(flag key, user id)to assign a stable 0–99 bucket per user.FlagsServiceand integrated withFeatureFlagsService.Related Issues
Closes #1953
Closes #1954
Closes #1955
Closes #1956