We have a query parameter for filters, which using the tantivy QueryParser syntax. However, that doesn't seem to support escaping URL characters (or perhaps it does, but I don't know how yet).
If tantivy won't fix this upstream, we'll have to look for a different approach. We could index the shortnames (i.e. serialize to JSON instead of JSON-AD). Additionally, we'll need to either 1) let the front-end use the shortnames too, or 2) let the server fetch the shortnames and use these after parsing a filter value.
Also, we don't test for this. Bad!