mirror of
https://github.com/grafana/grafana.git
synced 2025-02-25 18:55:37 -06:00
fix custom variable quoting in sql* query interpolations
This commit is contained in:
parent
9d3743774d
commit
bb7e583863
@ -16,7 +16,7 @@ export class MssqlDatasource {
|
||||
interpolateVariable(value, variable) {
|
||||
if (typeof value === 'string') {
|
||||
if (variable.multi || variable.includeAll) {
|
||||
return "'" + value + "'";
|
||||
return "'" + value.replace(/'/g, `''`) + "'";
|
||||
} else {
|
||||
return value;
|
||||
}
|
||||
@ -31,7 +31,7 @@ export class MssqlDatasource {
|
||||
return value;
|
||||
}
|
||||
|
||||
return "'" + val + "'";
|
||||
return "'" + val.replace(/'/g, `''`) + "'";
|
||||
});
|
||||
return quotedValues.join(',');
|
||||
}
|
||||
|
@ -218,6 +218,13 @@ describe('MSSQLDatasource', function() {
|
||||
});
|
||||
});
|
||||
|
||||
describe('and variable contains single quote', () => {
|
||||
it('should return a quoted value', () => {
|
||||
ctx.variable.multi = true;
|
||||
expect(ctx.ds.interpolateVariable("a'bc", ctx.variable)).toEqual("'a''bc'");
|
||||
});
|
||||
});
|
||||
|
||||
describe('and variable allows all and value is a string', () => {
|
||||
it('should return a quoted value', () => {
|
||||
ctx.variable.includeAll = true;
|
||||
|
@ -16,7 +16,7 @@ export class MysqlDatasource {
|
||||
interpolateVariable(value, variable) {
|
||||
if (typeof value === 'string') {
|
||||
if (variable.multi || variable.includeAll) {
|
||||
return "'" + value + "'";
|
||||
return "'" + value.replace(/'/g, `''`) + "'";
|
||||
} else {
|
||||
return value;
|
||||
}
|
||||
@ -31,7 +31,7 @@ export class MysqlDatasource {
|
||||
return value;
|
||||
}
|
||||
|
||||
return "'" + val + "'";
|
||||
return "'" + val.replace(/'/g, `''`) + "'";
|
||||
});
|
||||
return quotedValues.join(',');
|
||||
}
|
||||
|
@ -214,6 +214,13 @@ describe('MySQLDatasource', function() {
|
||||
});
|
||||
});
|
||||
|
||||
describe('and variable contains single quote', () => {
|
||||
it('should return a quoted value', () => {
|
||||
ctx.variable.multi = true;
|
||||
expect(ctx.ds.interpolateVariable("a'bc", ctx.variable)).toEqual("'a''bc'");
|
||||
});
|
||||
});
|
||||
|
||||
describe('and variable allows all and value is a string', () => {
|
||||
it('should return a quoted value', () => {
|
||||
ctx.variable.includeAll = true;
|
||||
|
@ -16,7 +16,7 @@ export class PostgresDatasource {
|
||||
interpolateVariable(value, variable) {
|
||||
if (typeof value === 'string') {
|
||||
if (variable.multi || variable.includeAll) {
|
||||
return "'" + value + "'";
|
||||
return "'" + value.replace(/'/g, `''`) + "'";
|
||||
} else {
|
||||
return value;
|
||||
}
|
||||
@ -27,7 +27,7 @@ export class PostgresDatasource {
|
||||
}
|
||||
|
||||
var quotedValues = _.map(value, function(val) {
|
||||
return "'" + val + "'";
|
||||
return "'" + val.replace(/'/g, `''`) + "'";
|
||||
});
|
||||
return quotedValues.join(',');
|
||||
}
|
||||
|
@ -215,6 +215,13 @@ describe('PostgreSQLDatasource', function() {
|
||||
});
|
||||
});
|
||||
|
||||
describe('and variable contains single quote', () => {
|
||||
it('should return a quoted value', () => {
|
||||
ctx.variable.multi = true;
|
||||
expect(ctx.ds.interpolateVariable("a'bc", ctx.variable)).toEqual("'a''bc'");
|
||||
});
|
||||
});
|
||||
|
||||
describe('and variable allows all and is a string', () => {
|
||||
it('should return a quoted value', () => {
|
||||
ctx.variable.includeAll = true;
|
||||
|
Loading…
Reference in New Issue
Block a user