Update VideoConntroller

Author: dansup

app/Http/Controllers/Api/VideoController.php

@@ -11,6 +11,7 @@
 use App\Http\Requests\StoreCommentUpdateRequest;
 use App\Http\Requests\StoreVideoRequest;
 use App\Http\Requests\UpdateVideoRequest;
+use App\Http\Resources\AccountCompactResource;
 use App\Http\Resources\CommentCaptionEditResource;
 use App\Http\Resources\CommentReplyCaptionEditResource;
 use App\Http\Resources\CommentReplyResource;
@@ -61,20 +62,36 @@ public function __construct()
 
     public function showAutocompleteTags(Request $request)
     {
-        $request->validate(['q' => 'required|string|min:2|max:60']);
+        $validated = $request->validate(['q' => 'required|alpha_dash|min:2|max:60']);
 
-        $hashtags = Hashtag::where('name', 'like', $request->input('q').'%')->whereCanSearch(true)->limit(10)->get();
+        $q = trim($validated['q']);
+
+        $escaped = $this->escapeLike($q);
+
+        $hashtags = Hashtag::where('name', 'like', $escaped.'%')->whereCanSearch(true)->limit(10)->get();
 
         return HashtagResource::collection($hashtags);
     }
 
     public function showAutocompleteAccounts(Request $request)
     {
-        $request->validate(['q' => 'required|string|min:2|max:90']);
+        $validated = $request->validate([
+            'q' => [
+                'required',
+                'string',
+                'min:2',
+                'max:90',
+                'regex:/^[A-Za-z0-9.\-_@]+$/',
+            ],
+        ]);
+
+        $q = trim($validated['q']);
 
-        $profiles = Profile::where('username', 'like', $request->input('q').'%')->where('is_hidden', false)->limit(10)->get();
+        $escaped = $this->escapeLike($q);
 
-        return ProfileResource::collection($profiles);
+        $profiles = Profile::where('username', 'like', $escaped.'%')->where('is_hidden', false)->limit(10)->get();
+
+        return AccountCompactResource::collection($profiles);
     }
 
     /**
@@ -767,4 +784,13 @@ public function getAutocompleteHashtag(GetMentionAutocomplete $request)
 
         return HashtagResource::collection($res);
     }
+
+    private function escapeLike(string $value): string
+    {
+        return str_replace(
+            ['\\', '%', '_'],
+            ['\\\\', '\\%', '\\_'],
+            $value
+        );
+    }
 }