Make sure to filter wildcard queries

Fixes #640

data/model/_basequery.py

@@ -1,10 +1,22 @@
-from peewee import JOIN_LEFT_OUTER
+from peewee import JOIN_LEFT_OUTER, Clause, SQL
 from cachetools import lru_cache
 
 from data.database import (Repository, User, Team, TeamMember, RepositoryPermission, TeamRole,
                            Namespace, Visibility, db_for_update)
 
 
+def prefix_search(field, prefix_query):
+  """ Returns the wildcard match for searching for the given prefix query. """
+  # Escape the known wildcard characters.
+  prefix_query = (prefix_query
+    .replace('!', '!!')
+    .replace('%', '!%')
+    .replace('_', '!_')
+    .replace('[', '!['))
+
+  return field ** Clause(prefix_query + '%', SQL("ESCAPE '!'"))
+
+
 def get_existing_repository(namespace_name, repository_name, for_update=False):
   query = (Repository
            .select(Repository, Namespace)