diff --git a/src/backend/core/services/search_indexers.py b/src/backend/core/services/search_indexers.py index a4bb9eec..3b064753 100644 --- a/src/backend/core/services/search_indexers.py +++ b/src/backend/core/services/search_indexers.py @@ -244,7 +244,12 @@ class SearchIndexer(BaseDocumentIndexer): """ doc_path = document.path doc_content = document.content - text_content = utils.base64_yjs_to_text(doc_content) if doc_content else "" + + # Encrypted content is ciphertext and it should never be indexed for search + if document.is_encrypted: + text_content = "" + else: + text_content = utils.base64_yjs_to_text(doc_content) if doc_content else "" return { "id": str(document.id), diff --git a/src/backend/core/tests/test_services_search_indexers.py b/src/backend/core/tests/test_services_search_indexers.py index 61488a92..f9fe7414 100644 --- a/src/backend/core/tests/test_services_search_indexers.py +++ b/src/backend/core/tests/test_services_search_indexers.py @@ -239,6 +239,18 @@ def test_services_search_indexers_serialize_document_empty(): assert result["title"] == "" +@pytest.mark.usefixtures("indexer_settings") +def test_services_search_indexers_serialize_document_encrypted(): + """Encrypted documents should have empty content to avoid indexing ciphertext.""" + document = factories.DocumentFactory(is_encrypted=True) + + indexer = SearchIndexer() + result = indexer.serialize_document(document, {}) + + assert result["content"] == "" + assert result["size"] == 0 + + @responses.activate def test_services_search_indexers_index_errors(indexer_settings): """