disallow reserved characters

[stleusc]

Tandoor Version

latest

Setup

Docker / Docker-Compose

Reverse Proxy

No reverse proxy

Other

No response

Bug description

Create a recipe with:

• add ingredient with % as a unit
• add another ingredient and type % as unit in the search box

Box shows '% create' despite the fact that % as a unit exists already!
Expected: '% select' since % already exists

Relevant logs

No response

[smilerz]

% is a reserved character and can't be used in an API (which drives the search).

@vabene1111 - we should probably limit using reserved characters or explicitly encode/decode them.

(for reference: ! * ' ( ) ; : @ & = + $ , / ? % # [ ] are all reserved)

[vabene1111]

Hmm yea, its all escaped and as you said stripped by the API but the new frontend should probably have some validation to dissallow those characters at least in any name field