docs: enumerate escaped chars in duplicate escape fns

Both escape_query_string copies now list the exact current set of escaped characters, making sync audits easier without needing to diff two files.

Author: jhult

native/tantivy-c/src/lib.rs

@@ -406,13 +406,14 @@ fn string_to_c_string(s: &str) -> *mut c_char {
     }
 }
 
-// Helper: Escape special characters in query strings to prevent injection (CWE-78)
+// Helper: Escape special characters in query strings to prevent query injection
 //
 // NOTE: This function is duplicated in src/tantivy/query_builder.inko
 // Both versions must be kept in sync. Any changes to the special character
 // list must be applied to both locations.
 //
-// Full list of Tantivy/Lucene special chars: " ' + - ( ) [ ] : * ? \ ^ ~ { } | ! and whitespace
+// Current escaped set (must match query_builder.inko::is_special_char):
+//   " ' + - ( ) [ ] : * ? \ space ^ ~ { } | !
 fn escape_query_string(s: &str) -> String {
     let mut result = String::with_capacity(s.len() * 2);
     for c in s.chars() {

src/tantivy/query_builder.inko

@@ -81,7 +81,8 @@ impl TantivyQueryBuilder {
 # Both versions must be kept in sync. Any changes to the special character
 # list must be applied to both locations.
 #
-# Full list of Tantivy/Lucene special chars: " ' + - ( ) [ ] : * ? \ ^ ~ { } | ! and space
+# Current escaped set (must match lib.rs::escape_query_string):
+#   " ' + - ( ) [ ] : * ? \ space ^ ~ { } | !
 fn escape_query_string(s: String) -> String {
   let mut buffer = StringBuffer.new