#7941 broke searches with spaces in them

[LawnGnome]

See also: https://rust-lang.zulipchat.com/#narrow/stream/318791-t-crates-io/topic/can't.20search.20with.20a.20space

@eth3lbert, could you have a look, please?

[carols10cents]

Yeah, sorry I didn't review the original PR... the walk_ast function makes me feel really nervous in general because it sure looks like it's manipulating a raw SQL query, which is fraught with peril and injection vectors.

Is that part of the PR necessary?

[eth3lbert]

I sincerely apologize for the system disruption caused by my recent changes.

I've identified the problematic code https://github.com/eth3lbert/crates.io/blob/c4cb2b13b6790107c7d637941b9429b334998319/src/controllers/krate/search.rs#L101-L104
and https://github.com/eth3lbert/crates.io/blob/c4cb2b13b6790107c7d637941b9429b334998319/src/controllers/krate/search.rs#L310-L313 , which involves the use of the to_tsquery_with_search_config for tsquery from the diesel_full_text_search library. Reverting this specific part back to the original code should restore functionality as expected.

[eth3lbert]

Yeah, sorry I didn't review the original PR... the walk_ast function makes me feel really nervous in general because it sure looks like it's manipulating a raw SQL query, which is fraught with peril and injection vectors.

Is that part of the PR necessary?

I believe this approach is secure because it's functionally equivalent to other uses of query. The count query is provided by the programmer, generated by Diesel, and used as a subquery within a specific location. As long as the provided query itself is secure, this method should also be secure.