Escape special regex characters

CHANGELOG.md

@@ -43,6 +43,7 @@ All notable changes to this project will be documented in this file.
 - Log mailer errors plausible/analytics#3336
 - Allow custom event timeseries in stats API plausible/analytics#3505
 - Fixes for sites with UTF characters in domain plausible/analytics#3560
+- Fix crash when using special characters in filter plausible/analytics#3634
 
 ## v2.0.0 - 2023-07-12
 

lib/plausible/stats/base.ex

@@ -542,16 +542,15 @@ defmodule Plausible.Stats.Base do
     {first_datetime, last_datetime}
   end
 
-  @replaces %{
-    ~r/\*\*/ => ".*",
-    ~r/(?<!\.)\*/ => "[^/]*",
-    "(" => "\\(",
-    ")" => "\\)"
-  }
   def page_regex(expr) do
-    Enum.reduce(@replaces, "^#{expr}$", fn {pattern, replacement}, regex ->
-      String.replace(regex, pattern, replacement)
-    end)
+    escaped =
+      expr
+      |> Regex.escape()
+      |> String.replace("\\|", "|")
+      |> String.replace("\\*\\*", ".*")
+      |> String.replace("\\*", ".*")
+
+    "^#{escaped}$"
   end
 
   defp split_goals(clauses, map_fn \\ &Function.identity/1) do

test/plausible_web/controllers/api/external_stats_controller/aggregate_test.exs

@@ -457,6 +457,23 @@ defmodule PlausibleWeb.Api.ExternalStatsController.AggregateTest do
              }
     end
 
+    test "wildcard referrer filter with special regex characters", %{conn: conn, site: site} do
+      populate_stats(site, [
+        build(:pageview, referrer: "https://a.com"),
+        build(:pageview, referrer: "https://a.com"),
+        build(:pageview, referrer: "https://ab.com")
+      ])
+
+      conn =
+        get(conn, "/api/v1/stats/aggregate", %{
+          "site_id" => site.domain,
+          "metrics" => "visitors",
+          "filters" => "visit:referrer==**a.com**"
+        })
+
+      assert json_response(conn, 200)["results"] == %{"visitors" => %{"value" => 2}}
+    end
+
     test "can filter by utm_medium", %{conn: conn, site: site} do
       populate_stats(site, [
         build(:pageview,

test/plausible_web/controllers/api/stats_controller/conversions_test.exs

@@ -625,13 +625,10 @@ defmodule PlausibleWeb.Api.StatsController.ConversionsTest do
       insert(:goal, %{site: site, page_path: "/register"})
       insert(:goal, %{site: site, page_path: "/reg*"})
       insert(:goal, %{site: site, page_path: "/*/register"})
-      insert(:goal, %{site: site, page_path: "/billing**/success"})
       insert(:goal, %{site: site, page_path: "/billing*/success"})
       insert(:goal, %{site: site, page_path: "/signup"})
       insert(:goal, %{site: site, page_path: "/signup/*"})
-      insert(:goal, %{site: site, page_path: "/signup/**"})
       insert(:goal, %{site: site, page_path: "/*"})
-      insert(:goal, %{site: site, page_path: "/**"})
 
       populate_stats(site, [
         build(:pageview,
@@ -678,25 +675,19 @@ defmodule PlausibleWeb.Api.StatsController.ConversionsTest do
                %{
                  "conversion_rate" => 100.0,
                  "visitors" => 8,
-                 "name" => "Visit /**",
+                 "name" => "Visit /*",
                  "events" => 8
                },
                %{
                  "conversion_rate" => 37.5,
                  "visitors" => 3,
-                 "name" => "Visit /signup/**",
-                 "events" => 3
-               },
-               %{
-                 "conversion_rate" => 37.5,
-                 "visitors" => 3,
-                 "name" => "Visit /*",
+                 "name" => "Visit /signup/*",
                  "events" => 3
                },
                %{
                  "conversion_rate" => 25.0,
                  "visitors" => 2,
-                 "name" => "Visit /billing**/success",
+                 "name" => "Visit /billing*/success",
                  "events" => 2
                },
                %{
@@ -705,18 +696,6 @@ defmodule PlausibleWeb.Api.StatsController.ConversionsTest do
                  "name" => "Visit /reg*",
                  "events" => 2
                },
-               %{
-                 "conversion_rate" => 12.5,
-                 "visitors" => 1,
-                 "name" => "Visit /signup/*",
-                 "events" => 1
-               },
-               %{
-                 "conversion_rate" => 12.5,
-                 "visitors" => 1,
-                 "name" => "Visit /billing*/success",
-                 "events" => 1
-               },
                %{
                  "conversion_rate" => 12.5,
                  "visitors" => 1,