fixed potential sql injection with new tags feature

[paullizer]

Bug Fixes

• Tag Filter Input Sanitization (Injection Prevention)
  • Added sanitize_tags_for_filter() function to validate tag filter inputs against the same ^[a-z0-9_-]+$ character whitelist enforced when saving tags.
  • Previously, tag filter values from query parameters only passed through normalize_tag() (strip + lowercase) without character validation, allowing arbitrary characters to reach OData filter construction in build_tags_filter().
  • Hardened build_tags_filter() in functions_search.py to validate tags before interpolating into OData expressions, eliminating the OData injection vector.
  • Updated tag filter parsing in personal, group, and public document routes to use sanitize_tags_for_filter() for defense-in-depth.
  • Invalid tag filter values are silently dropped (they cannot match any stored tag).
  • Files Modified: functions_documents.py, functions_search.py, route_backend_documents.py, route_backend_group_documents.py, route_backend_public_documents.py.
  • (Ref: TAG_FILTER_INJECTION_FIX.md, sanitize_tags_for_filter)

[Copilot]

Pull request overview

This PR hardens document tag filtering to prevent OData filter injection in Azure AI Search by validating tag filter inputs against the same whitelist used when tags are saved.

Changes:

• Added sanitize_tags_for_filter() to normalize + validate tag filter inputs and drop invalid entries.
• Updated personal/group/public document listing routes to use sanitize_tags_for_filter() when parsing tags filters.
• Hardened build_tags_filter() in functions_search.py to validate tags before building OData filter expressions; added functional test + fix documentation + release notes; bumped version to 0.238.025.

Reviewed changes

Copilot reviewed 9 out of 11 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
functional_tests/test_tag_filter_sanitization.py	Adds a functional regression test covering valid/invalid tag filter inputs and injection-style payloads.
docs/explanation/release_notes.md	Documents the fix under v0.238.025 release notes.
docs/explanation/fixes/TAG_FILTER_INJECTION_FIX.md	Adds a dedicated fix write-up with root cause + validation notes.
application/single_app/route_backend_documents.py	Uses sanitize_tags_for_filter() when parsing tags query filter (personal docs).
application/single_app/route_backend_group_documents.py	Uses sanitize_tags_for_filter() when parsing tags query filter (group docs).
application/single_app/route_backend_public_documents.py	Uses sanitize_tags_for_filter() when parsing tags query filter (public docs).
application/single_app/functions_search.py	Validates tags via sanitize_tags_for_filter() before interpolating into OData filter expressions.
application/single_app/functions_documents.py	Introduces sanitize_tags_for_filter() to enforce the tag whitelist + length limit for filter inputs.
application/single_app/config.py	Version bump from 0.238.024 → 0.238.025.

[Bionic711]

Looks good!