IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2025-02-25 18:55:37 -06:00
Code Issues Packages Projects Releases Wiki Activity

fix custom variable quoting in sql* query interpolations

Browse Source
This commit is contained in:
Brice Maron 2018-08-01 19:38:13 +02:00
parent 9d3743774d
commit bb7e583863
6 changed files with 27 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
public/app/plugins/datasource/mssql/datasource.ts
View File

@ -16,7 +16,7 @@ export class MssqlDatasource {
interpolateVariable(value, variable) { interpolateVariable(value, variable) {
if (typeof value === 'string') { if (typeof value === 'string') {
if (variable.multi || variable.includeAll) { if (variable.multi || variable.includeAll) {
return "'" + value + "'"; return "'" + value.replace(/'/g, `''`) + "'";
} else { } else {
return value; return value;
} }
@ -31,7 +31,7 @@ export class MssqlDatasource {
return value; return value;
} }
return "'" + val + "'"; return "'" + val.replace(/'/g, `''`) + "'";
}); });
return quotedValues.join(','); return quotedValues.join(',');
} }

7
public/app/plugins/datasource/mssql/specs/datasource.jest.ts
View File

@ -218,6 +218,13 @@ describe('MSSQLDatasource', function() {
}); });
}); });
describe('and variable contains single quote', () => {
it('should return a quoted value', () => {
ctx.variable.multi = true;
expect(ctx.ds.interpolateVariable("a'bc", ctx.variable)).toEqual("'a''bc'");
});
});
describe('and variable allows all and value is a string', () => { describe('and variable allows all and value is a string', () => {
it('should return a quoted value', () => { it('should return a quoted value', () => {
ctx.variable.includeAll = true; ctx.variable.includeAll = true;

4
public/app/plugins/datasource/mysql/datasource.ts
View File

@ -16,7 +16,7 @@ export class MysqlDatasource {
interpolateVariable(value, variable) { interpolateVariable(value, variable) {
if (typeof value === 'string') { if (typeof value === 'string') {
if (variable.multi || variable.includeAll) { if (variable.multi || variable.includeAll) {
return "'" + value + "'"; return "'" + value.replace(/'/g, `''`) + "'";
} else { } else {
return value; return value;
} }
@ -31,7 +31,7 @@ export class MysqlDatasource {
return value; return value;
} }
return "'" + val + "'"; return "'" + val.replace(/'/g, `''`) + "'";
}); });
return quotedValues.join(','); return quotedValues.join(',');
} }

7
public/app/plugins/datasource/mysql/specs/datasource.jest.ts
View File

@ -214,6 +214,13 @@ describe('MySQLDatasource', function() {
}); });
}); });
describe('and variable contains single quote', () => {
it('should return a quoted value', () => {
ctx.variable.multi = true;
expect(ctx.ds.interpolateVariable("a'bc", ctx.variable)).toEqual("'a''bc'");
});
});
describe('and variable allows all and value is a string', () => { describe('and variable allows all and value is a string', () => {
it('should return a quoted value', () => { it('should return a quoted value', () => {
ctx.variable.includeAll = true; ctx.variable.includeAll = true;

4
public/app/plugins/datasource/postgres/datasource.ts
View File

@ -16,7 +16,7 @@ export class PostgresDatasource {
interpolateVariable(value, variable) { interpolateVariable(value, variable) {
if (typeof value === 'string') { if (typeof value === 'string') {
if (variable.multi || variable.includeAll) { if (variable.multi || variable.includeAll) {
return "'" + value + "'"; return "'" + value.replace(/'/g, `''`) + "'";
} else { } else {
return value; return value;
} }
@ -27,7 +27,7 @@ export class PostgresDatasource {
} }
var quotedValues = _.map(value, function(val) { var quotedValues = _.map(value, function(val) {
return "'" + val + "'"; return "'" + val.replace(/'/g, `''`) + "'";
}); });
return quotedValues.join(','); return quotedValues.join(',');
} }

7
public/app/plugins/datasource/postgres/specs/datasource.jest.ts
View File

@ -215,6 +215,13 @@ describe('PostgreSQLDatasource', function() {
}); });
}); });
describe('and variable contains single quote', () => {
it('should return a quoted value', () => {
ctx.variable.multi = true;
expect(ctx.ds.interpolateVariable("a'bc", ctx.variable)).toEqual("'a''bc'");
});
});
describe('and variable allows all and is a string', () => { describe('and variable allows all and is a string', () => {
it('should return a quoted value', () => { it('should return a quoted value', () => {
ctx.variable.includeAll = true; ctx.variable.includeAll = true;