Formal models and scripts: queryparser-flexible-simple-xml

Tools: Python

These are the working models and scripts this part of the hunt used. Some encode the code as it is (a counterexample is the expected result), others a fixed or correct variant; read the header comment of each file. Paths inside them were replaced by placeholders such as $LUCENE (a Lucene checkout) and $WORK.

Findings

• Flexible query parser: QueryNode#toQueryString prints field names without escaping, so nodes for escaped field names such as 'my field' or 'a:b' print strings that parse to a different query or do not parse (finding LFV-356; repro · finding page)
• Flexible query parser: EscapeQuerySyntaxImpl does not escape '@' after the first character of a term or a term that is exactly && or ||, so QueryNode#toQueryString output for such terms does not parse (finding LFV-398; repro · finding page)

Files

• flexible-escaper-leaves-at-sign-and-andor-words-unescaped/model/classify_syntax.py (used for LFV-398)
• flexible-toquerystring-field-names-not-escaped/model/classify_syntax.py (used for LFV-356)

How to run

• Python: python3 <file>.py; scripts that import z3 need the z3-solver package.

Snapshot of 2026-11-03. AI-assisted; not yet triaged by a human Lucene committer. Feedback: open an issue in lucene-ai-bug-hunt.