#434

backend/app/services/counts_candidates.rb

@@ -41,17 +41,16 @@ class CountsCandidates
           .to_sql
     end
     clauses = []
-    binds = []
     if @params['category'].present?
-      clauses << 'category = ?'
-      binds << @params['category']
+      clauses << ApplicationRecord.sanitize_sql_array(['category = ?', @params['category']])
     end
     where = clauses.empty? ? '' : "WHERE #{ clauses.join(' AND ') }"
     sql = <<~SQL
       SELECT /*+ MAX_EXECUTION_TIME(10000) */ * FROM (#{ sources.join(' UNION ALL ') }) choices
       #{ where } ORDER BY kind, id LIMIT #{ LIMIT + 1 } OFFSET #{ (@page - 1) * LIMIT }
     SQL
-    rows = connection.select_all(ApplicationRecord.sanitize_sql_array([sql, *binds])).to_a
+    # Sources already contain quoted search terms. Do not reinterpret their % or ? as binds.
+    rows = connection.select_all(sql).to_a
     rows.each { _1['names'] = JSON.parse(_1['names']) if _1['names'].is_a?(String) }
     { rows: rows.first(LIMIT), page: @page, more: rows.length > LIMIT,
       execution_at: internal.at.iso8601(6) }