AIKIDO-2026-185607

TL;DR

The escape_contains/1, escape_starts_with/1, and escape_ends_with/1 helpers in lib/expr.ex build SQL LIKE patterns from user-supplied search terms. They escape % and _ wildcards but do not escape existing backslashes, so input such as \% survives as an active wildcard because backslash is the default LIKE escape character in Postgres and MySQL. User-controlled search terms can then inject wildcards to probe column values character by character or bypass negated contains() filters used as access controls. The fix escapes backslashes before the other special characters so the pattern matches the literal input.