Skip to content

fix: escape RediSearch special characters in group_id fulltext queries#1295

Open
StephenBadger wants to merge 1 commit intogetzep:mainfrom
StephenBadger:fix/falkordb-redisearch-group-id-escaping
Open

fix: escape RediSearch special characters in group_id fulltext queries#1295
StephenBadger wants to merge 1 commit intogetzep:mainfrom
StephenBadger:fix/falkordb-redisearch-group-id-escaping

Conversation

@StephenBadger
Copy link
Copy Markdown

Summary

  • Group IDs containing hyphens or other RediSearch special characters (e.g. "my-group", "ap-erp") cause RediSearch: Syntax error in FalkorDB fulltext search queries
  • The hyphen - is interpreted as the RediSearch NOT operator rather than a literal character, even when the value is double-quoted
  • Error manifests as: RediSearch: Syntax error at offset 14 near ap

Fix

  • Added _escape_redisearch_value() helper that backslash-escapes RediSearch special characters (,.<>{}[]"':;!@#$%^&*()-+=~?|/\) before interpolating group_ids into fulltext query strings
  • Applied the fix to both query builder locations:
    • _build_falkor_fulltext_query() in search_ops.py (used by FalkorSearchOperations)
    • FalkorDriver.build_fulltext_query() in falkordb_driver.py (used by search_utils.fulltext_query() fallback path)

Before/After

# Before: RediSearch syntax error
(@group_id:"ap-erp") (search terms)

# After: properly escaped
(@group_id:ap\-erp) (search terms)

Reproduction

  1. Create a Graphiti instance with FalkorDB
  2. Ingest data with group_id="my-group" (any group_id containing a hyphen)
  3. Call search_() or search() with group_ids=["my-group"]
  4. Observe RediSearch: Syntax error

Group IDs containing hyphens or other RediSearch special characters
(e.g. "my-group") cause syntax errors in FalkorDB fulltext search
queries. The hyphen is interpreted as the RediSearch NOT operator
rather than a literal character.

Added _escape_redisearch_value() to backslash-escape special
characters before interpolating group_ids into fulltext query strings.
Applied the fix to both query builder locations:
- _build_falkor_fulltext_query() in search_ops.py
- FalkorDriver.build_fulltext_query() in falkordb_driver.py
@danielchalef
Copy link
Copy Markdown
Member

danielchalef commented Mar 3, 2026

All contributors have signed the CLA ✍️ ✅
Posted by the CLA Assistant Lite bot.

@StephenBadger
Copy link
Copy Markdown
Author

I have read the CLA Document and I hereby sign the CLA

@StephenBadger
Copy link
Copy Markdown
Author

recheck

danielchalef added a commit that referenced this pull request Mar 3, 2026
Copy link
Copy Markdown

@Onebrownsound Onebrownsound left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Independently, I encountered this quirk and this looks to be the fix I'd do. I'd add a small test case asserting the stripping behavior other than that I'd approve.

ehfazrezwan added a commit to ehfazrezwan/neuralscape that referenced this pull request Apr 2, 2026
feafc42 Bump the uv group across 2 directories with 2 updates (getzep#1363)
c4e6923 Upstream Zep internal improvements (getzep#1361)
e88c09c @VictorECDSA has signed the CLA in getzep#1356
91fe7e0 @majiayu000 has signed the CLA in getzep#1351
c52786d @dudo has signed the CLA in getzep#1350
d631437 @Ker102 has signed the CLA in getzep#1339
73cff2c @chengjon has signed the CLA in getzep#1340
8c61763 @rhlsthrm has signed the CLA in getzep#1335
e6424ba @pratyush618 has signed the CLA in getzep#1332
6f05647 @bsolomon1124 has signed the CLA in getzep#1330
10d9139 @spencer2211 has signed the CLA in getzep#1326
1ca1468 Add hiring promotion section to README (getzep#1323)
19e44a9 Bump mcp-server to 1.0.2 and require graphiti-core>=0.28.2 (getzep#1317)
77b1609 Bump graphiti-core version to 0.28.2 (getzep#1315)
7d65d5e Harden search filters against Cypher injection (getzep#1312)
b10b488 Restore README title and subtitle (getzep#1314)
a9065fa Refresh README content and fix image refs (getzep#1313)
5a334ec @lvca has signed the CLA in getzep#1310
45c8040 @jawherkh has signed the CLA in getzep#1309
9eb2c9e @kraft87 has signed the CLA in getzep#1305
334c8fa @adsharma has signed the CLA in getzep#1296
b6f9d87 @StephenBadger has signed the CLA in getzep#1295
4b91076 feat: Add GLiNER2 hybrid LLM client (getzep#1284)
db54ce0 chore: update Docker images to graphiti-core 0.28.1 (getzep#1292)
edc71e8 @devmao has signed the CLA in getzep#1289
b4ddc55 @carlos-alm has signed the CLA in getzep#1288
aa8e81e @giulio-leone has signed the CLA in getzep#1280
6fdb352 @aelhajj has signed the CLA in getzep#1281
2099603 @avianion has signed the CLA in getzep#1278
9eb59f7 @themavik has signed the CLA in getzep#1214
98f5b5f fix: replace edge name with uuid in debug log (getzep#1261)
510bd50 @hanxiao has signed the CLA in getzep#1257
17a8ea9 @sprotasovitsky has signed the CLA in getzep#1254
9d509a2 @Yifan-233-max has signed the CLA in getzep#1245
ef52a2a chore: regenerate lockfiles to drop diskcache (getzep#1244)
7605303 chore: bump version to 0.28.1 (getzep#1243)
bde2f79 fix: replace diskcache with sqlite-based cache to resolve CVE (getzep#1238)

git-subtree-dir: graphiti
git-subtree-split: feafc42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants