test: quotes are escaped

[sezanzeb]

Proposed Changes

Just adds a single test. I was investigating how to use flux but couldn't see if this escapes and prevents injection attacks.

Checklist

• CHANGELOG.md updated < I guess adding a test isn't really something worth mentioning there
• Rebased/mergeable < I guess so?
• A test has been added if appropriate
• yarn test completes successfully
• Commit messages are in semantic format
• Sign CLA (if not already signed) < Dude, just take it or leave it. I'm not interested in spending an hour trying to decipher this legal lingo for this. I don't care about having any rights about those 8 lines of code or whatever. I give this to you.

[sranka]

Thank @sezanzeb you for a PR, but I think that your changes do not bring any additional value to this library. The flux tagged template is designed exactly for the purpose that you double-checked, it is properly documented this way in https://influxdata.github.io/influxdb-client-js/influxdb-client.flux.html . All the possible value types and escape sequences are already tested thoroughly in flux.test.ts. A possible (but not a necessary improvement) would be to add

        if (pair.value !== undefined) {
          expect(flux`${pair.value}`.toString()).equals(pair.flux)
        } else {
          expect(() => flux`${pair.value}`.toString()).to.throw(
            "Unsupported parameter literal 'undefined' at index: 0, type: undefined"
          )
        }

right after

https://github.com/influxdata/influxdb-client-js/blob/master/packages/core/test/unit/query/flux.test.ts#L119

it will then extra test all parameter types and escape sequences within the flux tagged template.

[sezanzeb]

The only test that uses doubles quotes in flux is:

  it('processes a simple nested flux template', () => {
    const flux1 = flux`from(bucket:"my-bucket")`
    expect(flux`${flux1} |> range(start: ${0})")`.toString()).equals(
      'from(bucket:"my-bucket") |> range(start: 0)")'
    )
  })

but it is different. The new test that I added tries to insert a string containing a double-quote into another set of double-quotes in the target. There is no test that expects an escaped double-quote: \"

or what am I missing here?

There just isn't a test that makes sure that a user-defined string (like foo"bar) is not breaking the command

[sranka]

Thank you for your feedback.