fix(valkey): escape special chars in FT.SEARCH tag filter values (#5750)

tests/vector_stores/test_valkey.py

@@ -490,26 +490,6 @@ def test_reset(valkey_db, mock_valkey_client):
         assert result is True
 
 
-def test_build_list_query(valkey_db):
-    """Test building a list query with and without filters."""
-    # Test without filters
-    query = valkey_db._build_list_query(None)
-    assert query == "*"
-
-    # Test with empty filters
-    query = valkey_db._build_list_query({})
-    assert query == "*"
-
-    # Test with filters
-    query = valkey_db._build_list_query({"user_id": "test_user"})
-    assert query == "@user_id:{test_user}"
-
-    # Test with multiple filters
-    query = valkey_db._build_list_query({"user_id": "test_user", "agent_id": "test_agent"})
-    assert "@user_id:{test_user}" in query
-    assert "@agent_id:{test_agent}" in query
-
-
 def test_process_document_fields(valkey_db):
     """Test processing document fields from hash results."""
     # Create a mock result with all fields
@@ -1061,3 +1041,28 @@ def test_build_index_schema_indexes_memory_as_text(valkey_db):
     )
     # And it must not be declared as TAG.
     assert ["memory", "TAG"] != cmd[memory_idx : memory_idx + 2]
+
+
+def test_escape_tag_value_wildcards(valkey_db):
+    """Wildcard characters in filter values must be escaped to prevent query injection."""
+    assert "\\*" in valkey_db._escape_tag_value("*")
+    assert "\\|" in valkey_db._escape_tag_value("a|b")
+
+
+def test_build_search_query_escapes_filter_values(valkey_db):
+    """_build_search_query must escape special chars in filter values."""
+    knn_part = "[KNN 5 @embedding $vec_param AS vector_score]"
+    query = valkey_db._build_search_query(knn_part, {"user_id": "*"})
+    assert "\\*" in query
+    assert "@user_id:{\\*}" in query
+
+
+def test_escape_tag_value_normal_strings(valkey_db):
+    """Normal alphanumeric filter values must pass through unchanged."""
+    assert valkey_db._escape_tag_value("alice") == "alice"
+    assert valkey_db._escape_tag_value("user123") == "user123"
+
+
+def test_escape_tag_value_hyphenated_user_id(valkey_db):
+    """Hyphenated user IDs must have the hyphen escaped for exact-match."""
+    assert valkey_db._escape_tag_value("user-123") == r"user\-123"