From c59c47032150fd6b11fc40d488c98c9ce0d3d639 Mon Sep 17 00:00:00 2001
From: Pete Matsyburka <pete@docuseal.com>
Date: Sun, 9 Aug 2026 16:01:12 +0300
Subject: [PATCH] sanitize search query

---
 app/controllers/submitters_autocomplete_controller.rb | 2 +-
 lib/submitters.rb                                     | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/app/controllers/submitters_autocomplete_controller.rb b/app/controllers/submitters_autocomplete_controller.rb
index 22599e58..f93c8b96 100644
--- a/app/controllers/submitters_autocomplete_controller.rb
+++ b/app/controllers/submitters_autocomplete_controller.rb
@@ -36,7 +36,7 @@ class SubmittersAutocompleteController < ApplicationController
       else
         column = Submitter.arel_table[field.to_sym]
 
-        term = "#{params[:q].downcase}%"
+        term = "#{ActiveRecord::Base.sanitize_sql_like(params[:q].downcase)}%"
 
         submitters.where(column.matches(term))
       end
diff --git a/lib/submitters.rb b/lib/submitters.rb
index 09852001..979ba6bc 100644
--- a/lib/submitters.rb
+++ b/lib/submitters.rb
@@ -93,7 +93,8 @@ module Submitters
   def plain_search(submitters, keyword)
     return submitters if keyword.blank?
 
-    term = "%#{keyword.downcase}%"
+    sanitized = ActiveRecord::Base.sanitize_sql_like(keyword.downcase)
+    term = "%#{sanitized}%"
 
     arel_table = Submitter.arel_table