An apostrophe in `highlight_query` answers HTTP 500 with a parse error

Bug description

In a JSON /search request, any apostrophe inside highlight → highlight_query makes the daemon answer HTTP 500 with a parse error. The identical string is accepted as the main query, and the identical highlight query is accepted by SQL HIGHLIGHT().

The manual states the contract this breaks:

The highlight_query option enables highlighting based on a query that is different from the main search query. The syntax for highlight_query is the same as for the main query. — Searching/Highlighting.md

Reproduce

docker run --rm -d --name mant -p 19308:9308 manticoresearch/manticore:latest

curl -s 'http://127.0.0.1:19308/sql?mode=raw' --data-urlencode "query=CREATE TABLE t (content text)"
curl -s 'http://127.0.0.1:19308/sql?mode=raw' --data-urlencode "query=INSERT INTO t (id, content) VALUES (1, 'a lion\'s mane mushroom')"

1. As the main query — works, 1 hit

curl -s http://127.0.0.1:19308/search -H 'Content-Type: application/json' -d '
{"table":"t","query":{"query_string":"lion'"'"'s"},"limit":1,"_source":[""]}'

{"hits":{"total":1,"hits":[{"_id":1,"_score":2500,"_source":{}}]}}

2. As highlight_query — HTTP 500

curl -s http://127.0.0.1:19308/search -H 'Content-Type: application/json' -d '
{"table":"t","query":{"query_string":"mane"},"limit":1,"_source":[""],
 "highlight":{"fields":["content"],"highlight_query":{"query_string":"lion'"'"'s"},"allow_empty":true}}'

{"error":"table t: parse error: P09: syntax error, unexpected TOK_IDENT near '\"}')'"}

3. The match form fails the same way, and the error tail gains exactly one more closing brace — near '\"}}')' instead of near '\"}')':

curl -s http://127.0.0.1:19308/search -H 'Content-Type: application/json' -d '
{"table":"t","query":{"query_string":"mane"},"limit":1,"_source":[""],
 "highlight":{"fields":["content"],"highlight_query":{"match":{"content":"lion'"'"'s"}},"allow_empty":true}}'

That the leaked tail tracks the JSON nesting, and ends "}'), suggests the highlight options are re-serialized into a single-quoted string and the apostrophe closes it early. It is not the query parser: the same string parses fine in (1).

4. SQL HIGHLIGHT() with the same highlight query — works

curl -s 'http://127.0.0.1:19308/sql?mode=raw' --data-urlencode "query=SELECT HIGHLIGHT({allow_empty=1},'content','lion\'s') AS h FROM t WHERE MATCH('mane')"

{"h":"a <b>lion's</b> mane mushroom"}

Expected

highlight_query accepts what query accepts, per the manual.

No escaping works

The manual says non-" characters need double escaping in the JSON API. Every form was tried; all six are accepted by query and rejected by highlight_query. The value below is what the daemon receives after JSON decoding.

(Hit counts from a 71M-document table; the one-row repro above shows the same split.)

Related

No open or closed issue covers this. The nearest are #834 (a = in a search query broke the request, fixed 2023) and #4115 (quoted expressions not highlighted via SQL, fixed 2026-01) — the same family of "the highlight path does not take what the search path takes", but neither is this character or this endpoint.

Manticore Search version

28.6.6 e5feb9932@26073104 and 29.9.0 58e88d5ab@26091108. Identical behaviour on both.

Operating system version

Docker on Ubuntu (WSL2, kernel 6.6.87.2), image manticoresearch/manticore.

Have you tried the latest development version?

Yes — reproduces unchanged on manticoresearch/manticore:latest, 29.9.0.

How does this bug affect you?

Annoying, but I found a workaround. Any brand or name spelled with an apostrophe — McDonald's, Kellogg's, Reese's, Lion's Mane — makes the whole highlighted search fail. We strip apostrophes from the highlight query, which narrows the passage but avoids the 500.