search: lucky search does not unquote aliased patterns
Created by: rvantonder
The unquote rule would fire for content:"xyz"
syntax since xyz
is quoted. It's true that the pattern is quoted (as opposed to content:xyz
), but lucky search isn't meant to try unquote that syntax, because the quotes on patterns on fields like content
are never searched literally. This updates the unquote
rule to only apply to quoted patterns that do not have content:
in front of them (i.e., not aliased).
Test plan
Adds test.