From 5a1a7becb718fac8bb50ac49e064fcb16ff3d343 Mon Sep 17 00:00:00 2001
From: Roman Pushkov <pushkovroman@me.com>
Date: Tue, 21 Jan 2020 17:19:45 +0300
Subject: [PATCH 1/2] add tests

---
 test/diff_web/live/search_view_test.exs | 36 ++++++++++++++++++++++---
 1 file changed, 33 insertions(+), 3 deletions(-)

diff --git a/test/diff_web/live/search_view_test.exs b/test/diff_web/live/search_view_test.exs
index 149b187..80bffe0 100644
--- a/test/diff_web/live/search_view_test.exs
+++ b/test/diff_web/live/search_view_test.exs
@@ -32,7 +32,7 @@ defmodule DiffWeb.SearchLiveViewTest do
     end
 
     test "searching for packages that do exist", %{conn: conn} do
-      {:ok, view, html} = live(conn, "/")
+      {:ok, view, _html} = live(conn, "/")
 
       Diff.Package.StoreMock
       |> expect(:get_names, fn -> ["phoenix", "phoenix_live_view"] end)
@@ -53,8 +53,38 @@ defmodule DiffWeb.SearchLiveViewTest do
       refute rendered =~ ~s(Package phoenix not found.)
     end
 
+    test "do not search if the query is too long", %{conn: conn} do
+      {:ok, view, _html} = live(conn, "/")
+
+      Diff.Package.StoreMock
+      |> expect(:get_names, fn -> ["phoenix", "phoenix_live_view"] end)
+      |> expect(:get_versions, fn "phoenix" -> {:ok, ["1.4.10", "1.4.11"]} end)
+      |> allow(self(), view.pid)
+
+      send(view.pid, {:search, "phoenix"})
+      rendered = render(view)
+
+      assert rendered =~
+               render_change(view, "search", %{"q" => "phoenix_phoenix_phoenix_phoenix_phoenix"})
+    end
+
+    test "do not search if the query has invalid characters", %{conn: conn} do
+      {:ok, view, _html} = live(conn, "/")
+
+      Diff.Package.StoreMock
+      |> expect(:get_names, fn -> ["phoenix", "phoenix_live_view"] end)
+      |> expect(:get_versions, fn "phoenix" -> {:ok, ["1.4.10", "1.4.11"]} end)
+      |> allow(self(), view.pid)
+
+      send(view.pid, {:search, "phoenix"})
+      rendered = render(view)
+
+      assert rendered =~ render_change(view, "search", %{"q" => "phoenix-"})
+      assert rendered =~ render_change(view, "search", %{"q" => "phoenixё"})
+    end
+
     test "clicking diff", %{conn: conn} do
-      {:ok, view, html} = live(conn, "/")
+      {:ok, view, _html} = live(conn, "/")
 
       Diff.Package.StoreMock
       |> expect(:get_names, fn -> ["phoenix"] end)
@@ -62,7 +92,7 @@ defmodule DiffWeb.SearchLiveViewTest do
       |> allow(self(), view.pid)
 
       send(view.pid, {:search, "phoenix"})
-      rendered = render(view)
+      render(view)
 
       assert render_click(view, "go", %{result: "phoenix", to: "1.4.11", from: "1.4.10"}) ==
                {:error, {:redirect, %{to: "/diff/phoenix/1.4.10..1.4.11"}}}

From c7580be4c51a28e6fa9a96c47ce117aaac25bc4f Mon Sep 17 00:00:00 2001
From: Roman Pushkov <pushkovroman@me.com>
Date: Tue, 21 Jan 2020 17:20:58 +0300
Subject: [PATCH 2/2] add handling

---
 lib/diff_web/live/search_view.ex | 28 ++++++++++++++++------------
 1 file changed, 16 insertions(+), 12 deletions(-)

diff --git a/lib/diff_web/live/search_view.ex b/lib/diff_web/live/search_view.ex
index 6a284d1..6b4f09d 100644
--- a/lib/diff_web/live/search_view.ex
+++ b/lib/diff_web/live/search_view.ex
@@ -5,16 +5,27 @@ defmodule DiffWeb.SearchLiveView do
     DiffWeb.SearchView.render("search.html", assigns)
   end
 
+  @valid_query ~r{^[a-zA-Z0-9_]+$}
+
   def mount(_session, socket) do
     {:ok, reset_state(socket)}
   end
 
   def handle_event("search", %{"q" => ""}, socket), do: {:noreply, reset_state(socket)}
 
+  def handle_event("search", %{"q" => query}, socket)
+      when byte_size(query) > 30 do
+    {:noreply, socket}
+  end
+
   def handle_event("search", %{"q" => query}, socket) do
-    query = String.downcase(query)
-    send(self(), {:search, query})
-    {:noreply, assign(socket, query: query)}
+    if String.match?(query, @valid_query) do
+      query = String.downcase(query)
+      send(self(), {:search, query})
+      {:noreply, assign(socket, query: query)}
+    else
+      {:noreply, socket}
+    end
   end
 
   def handle_event("search_" <> suggestion, _params, socket) do
@@ -30,11 +41,7 @@ defmodule DiffWeb.SearchLiveView do
     index_of_selected_from = Enum.find_index(releases, &(&1 == from))
     to_releases = Enum.slice(releases, (index_of_selected_from + 1)..-1)
 
-    {:noreply,
-     assign(socket,
-       from: from,
-       to_releases: to_releases
-     )}
+    {:noreply, assign(socket, from: from, to_releases: to_releases)}
   end
 
   def handle_event(
@@ -42,10 +49,7 @@ defmodule DiffWeb.SearchLiveView do
         %{"_target" => ["to"], "to" => to},
         socket
       ) do
-    {:noreply,
-     assign(socket,
-       to: to
-     )}
+    {:noreply, assign(socket, to: to)}
   end
 
   def handle_event("go", _params, %{assigns: %{result: result, to: to, from: from}} = socket)