Fix wildcard query with escaped backslash followed by wildcard (#19719) (#19756)

The getNonWildcardSequence method incorrectly handled cases where an
escaped backslash was followed by a wildcard character. It would check
if the character before a wildcard was a backslash, but didn't account
for that backslash itself being escaped.

For example, the query "*some\\*" (matching strings containing "some\")
would incorrectly return "some\\*" instead of "some\\", causing invalid
ngrams containing the wildcard character to be generated.

The fix counts consecutive backslashes before wildcards:
- Even count: wildcard is NOT escaped
- Odd count: wildcard IS escaped

---------

Signed-off-by: Deven Prajapati <pdevens09@gmail.com>
Signed-off-by: Deven009 <pdevens09@gmail.com>
Signed-off-by: Deven009 <37845204+Deven009@users.noreply.github.com>

Author: Deven009

CHANGELOG.md

@@ -77,6 +77,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 - Fix issue with updating core with a patch number other than 0 ([#19377](https://github.com/opensearch-project/OpenSearch/pull/19377))
 - [Java Agent] Allow JRT protocol URLs in protection domain extraction ([#19683](https://github.com/opensearch-project/OpenSearch/pull/19683))
 - Fix potential concurrent modification exception when updating allocation filters ([#19701])(https://github.com/opensearch-project/OpenSearch/pull/19701))
+- Fix wildcard query with escaped backslash followed by wildcard character ([#19719](https://github.com/opensearch-project/OpenSearch/pull/19719))
 - Fix file-based ingestion consumer to handle start point beyond max line number([#19757])(https://github.com/opensearch-project/OpenSearch/pull/19757))
 - Fix IndexOutOfBoundsException when running include/exclude on non-existent prefix in terms aggregations ([#19637](https://github.com/opensearch-project/OpenSearch/pull/19637))
 - Fixed assertion unsafe use of ClusterService.state() in ResourceUsageCollectorService ([#19775])(https://github.com/opensearch-project/OpenSearch/pull/19775))

server/src/main/java/org/opensearch/index/mapper/WildcardFieldMapper.java

@@ -505,10 +505,16 @@ static Set<String> getRequiredNGrams(String value, boolean regexpMode) {
         }
 
         private static String getNonWildcardSequence(String value, int startFrom) {
+            int consecutiveBackslashes = 0;
             for (int i = startFrom; i < value.length(); i++) {
                 char c = value.charAt(i);
-                if ((c == '?' || c == '*') && (i == 0 || value.charAt(i - 1) != '\\')) {
-                    return value.substring(startFrom, i);
+                if (c == '\\') {
+                    consecutiveBackslashes++;
+                } else {
+                    if ((c == '?' || c == '*') && consecutiveBackslashes % 2 == 0) {
+                        return value.substring(startFrom, i);
+                    }
+                    consecutiveBackslashes = 0;
                 }
             }
             // Made it to the end. No more wildcards.

server/src/test/java/org/opensearch/index/mapper/WildcardFieldTypeTests.java

@@ -142,6 +142,36 @@ public void testMultipleWildcardsInQuery() {
         assertFalse(actualMatchingQuery.getSecondPhaseMatcher().test("abcdzzzefgqqh"));
     }
 
+    public void testEscapedBackslashFollowedByWildcard() {
+        MappedFieldType ft = new WildcardFieldMapper.WildcardFieldType("field");
+
+        // Test case from issue #19719
+        // Pattern: *some\\* means "wildcard + 'some\' + wildcard"
+        // Should match strings like "some\string", "awesome\stuff", etc.
+
+        // Verify ngram generation doesn't include wildcard characters
+        Set<String> ngrams = WildcardFieldMapper.WildcardFieldType.getRequiredNGrams("*some\\\\*", false);
+        assertFalse("Ngrams should not contain wildcard characters", ngrams.stream().anyMatch(s -> s.contains("*")));
+        assertTrue(ngrams.contains("som"));
+        assertTrue(ngrams.contains("ome"));
+        assertTrue(ngrams.contains("me\\"));
+
+        // Test the query
+        Query query = ft.wildcardQuery("*some\\\\*", null, null);
+        assertTrue(query instanceof WildcardFieldMapper.WildcardMatchingQuery);
+
+        WildcardFieldMapper.WildcardMatchingQuery wildcardQuery = (WildcardFieldMapper.WildcardMatchingQuery) query;
+
+        // Second phase matcher should correctly match strings with backslash
+        assertTrue(wildcardQuery.getSecondPhaseMatcher().test("some\\string"));
+        assertTrue(wildcardQuery.getSecondPhaseMatcher().test("some\\"));
+        assertTrue(wildcardQuery.getSecondPhaseMatcher().test("prefix_some\\suffix"));
+
+        // Should not match strings without backslash
+        assertFalse(wildcardQuery.getSecondPhaseMatcher().test("somestring"));
+        assertFalse(wildcardQuery.getSecondPhaseMatcher().test("some/string"));
+    }
+
     public void testRegexpQuery() {
         String pattern = ".*apple.*";
         MappedFieldType ft = new WildcardFieldMapper.WildcardFieldType("field");