Merge pull request #358 from ramayer/escape_xml_in_delete_using_elementree

Escape xml in delete() using ElementTree

Author: acdha

pysolr.py

@@ -1119,11 +1119,18 @@ def delete(
             else:
                 doc_id = list(filter(None, id))
             if doc_id:
-                m = "<delete>%s</delete>" % "".join("<id>%s</id>" % i for i in doc_id)
+                et = ElementTree.Element("delete")
+                for one_doc_id in doc_id:
+                    subelem = ElementTree.SubElement(et, 'id')
+                    subelem.text = one_doc_id
+                m = ElementTree.tostring(et)
             else:
                 raise ValueError("The list of documents to delete was empty.")
         elif q is not None:
-            m = "<delete><query>%s</query></delete>" % q
+            et = ElementTree.Element("delete")
+            subelem = ElementTree.SubElement(et, 'query')
+            subelem.text = q
+            m = ElementTree.tostring(et)
 
         return self._update(
             m,

tests/test_client.py

@@ -909,6 +909,14 @@ def test_delete(self):
         self.assertEqual(len(self.solr.search("type_s:grandchild")), 1)
         self.solr.delete(q="price:[0 TO 15]")
         self.solr.delete(q="type_s:parent", commit=True)
+
+        # Test a query that would need to be quoted when using the XML API.
+        # Ids with a "<" character will give an error using v3.9.0 or earlier
+        self.solr.delete(id='cats<dogs')
+        # These will delete too much when using v3.9.0 or earlier.
+        self.solr.delete(q='id:*</query><query> id:999 AND id:9999')
+        self.solr.delete(id='doc_4</id><id>doc_3', commit=True)
+
         # one simple doc should remain
         # parent documents were also deleted but children remain as orphans
         self.assertEqual(len(self.solr.search("doc")), 1)