Lucene syntax as objects instead of query string in Azure search

Question

I would like to send the filter as a syntax tree, and not a query string, to Azure search. Ist that possible?
All I can find is to send the filter as a string.

I have a filter syntax like ( State eq 1 ) or ( Domain eq 'Love' ) but I'd like to send it parameterised to Azure search instead of as a string. (It's a security thing - I'd prefer not to have to escape/wash the indata but instead let Microsoft/Azure/Lucene take care of the details as they know more about the inner workings than I do.)

Basically: I'd like to

filter = 
  Or ( 
    Equal( "State", stateValue ), 
    Equal( "FieldName", domainValue )
  )

Instead of me doing it like

filter = $"( 'State' eq {MyStringEscapeFunction(stateValue)} ) " + 
  "or ( 'Love' eq {MyStringEscapeFunction(domainValue)} )"

Dan Gøran Lunde · Accepted Answer · 2022-11-15T10:06:56.503

Filters in Azure Cognitive Search must be specified via the $filter parameter using OData-syntax.

https://learn.microsoft.com/en-us/azure/search/search-query-odata-filter

Your example filter is a valid OData filter. Provided that you have an index where State is a number and Domain is text.

$filter=(State eq 1) or (Domain eq 'Love')

If I understand your question correctly, you have an application where the values 1 and 'Love' are inputs from end users. The Azure Search API will validate that the filter values are valid according to the datatype. Other than that, you are responsible for validating input to your application.

For example, assume that your input parameters are s and d for State and Domain, respectively. You risk someone trying to manipulate your filter to return results you did not intend:

yourpage.aspx?s=1&d=Love%27%20or%20Domain%20eq%20%27Hate

This could potentially cause your $filter query to become:

$filter=(State eq 1) or (Domain eq 'Love' or Domain eq 'Hate')

You are responsible for implementing validation. You must build a layer that validates end-user inputs before using it in a $filter query. Here you can validate that end users' state and domain input are limited to valid values before creating an OData filter. See examples here:

https://learn.microsoft.com/en-us/aspnet/core/mvc/models/validation?view=aspnetcore-7.0

Lucene syntax as objects instead of query string in Azure search

1 Answers1