allow lookups containing accentuation character (Unicode 0x0301)

 * they are simply ignored
 * in openrussian.lua, we delegate Unicode handling to SQLite
 * for Bash completions, we ignore accents during matching but (have to)
   preserve them in the prefix -- see comments.
 * also properly escape SQL strings preserving accidental code injection.
   This means we do not necessarily have to port openrussian-completion.bash
   to Lua.

1 files changed, 16 insertions, 4 deletions

diff --git a/openrussian-completion.bash b/openrussian-completion.bash
index 0facd31..fd27c06 100644
--- a/openrussian-completion.bash
+++ b/openrussian-completion.bash
@@ -3,13 +3,25 @@
 # NOTE: Uses SQL for matching instead of compgen, since it's probably not
 # a good idea to always retrieve all the words, although this happens anyway
 # when completing an empty word.
-#
-# FIXME: sqlite3 command-line tool does not provide a safe method for embedding
-# strings, so we should either properly escape $2 or write an external Lua script.
 
 _openrussian_completions()
 {
-	SQL="SELECT bare FROM words WHERE bare LIKE \"$2%\""
+	# NOTE: sqlite3's command-line tool does not provide a way to properly
+	# embed strings, so we try to escape it here.
+	WORD=$(echo -n "$2" | sed 's/"/""/g')
+
+	# This is a rather convoluted way of writing
+	# SELECT bare FROM words WHERE bare LIKE "${WORD}%";
+	# but allowing $WORD to contain accentuation characters, which can easily
+	# happen when cutting/pasting words from the openrussian.lua manpages or the
+	# internet.
+	# NOTE: This is merely a workaround since all completions will begin with
+	# $WORD including accents and end without accents, so the suggested completions
+	# will likely be with wrong accents.
+	# It seems to be impossible, at least in Bash, to rubout $WORD first.
+	SQL=$(printf 'SELECT "%s" || SUBSTR(bare, LENGTH(REPLACE("%s", "\u0301", ""))+1)
+	              FROM words WHERE bare LIKE REPLACE("%s%%", "\u0301", "")' \
+	             "$WORD" "$WORD" "$WORD")
 
 	# Calculate database path based on the installation path of the `openrussian`
 	# CLI tool. This way, we can avoid preprocessing the script during installation.