From 6851ad9f8cd685c7953b0a8e2e1ae6c97f075bda Mon Sep 17 00:00:00 2001 From: Kevin Yu Date: Thu, 2 May 2024 06:15:11 -0700 Subject: [PATCH] CloudWatch: Fix apostrophes in dimension values not being escaped (#87182) --- pkg/tsdb/cloudwatch/metric_data_query_builder.go | 5 +++-- pkg/tsdb/cloudwatch/metric_data_query_builder_test.go | 4 ++-- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/pkg/tsdb/cloudwatch/metric_data_query_builder.go b/pkg/tsdb/cloudwatch/metric_data_query_builder.go index 596fe7bf0a5..fbed54f5950 100644 --- a/pkg/tsdb/cloudwatch/metric_data_query_builder.go +++ b/pkg/tsdb/cloudwatch/metric_data_query_builder.go @@ -99,7 +99,7 @@ func buildSearchExpression(query *models.CloudWatchQuery, stat string) string { } sort.Strings(keys) for _, key := range keys { - values := escapeDoubleQuotes(knownDimensions[key]) + values := escapeQuotes(knownDimensions[key]) valueExpression := join(values, " OR ", `"`, `"`) if len(knownDimensions[key]) > 1 { valueExpression = fmt.Sprintf(`(%s)`, valueExpression) @@ -150,10 +150,11 @@ func buildSearchExpressionLabel(query *models.CloudWatchQuery) string { return label } -func escapeDoubleQuotes(arr []string) []string { +func escapeQuotes(arr []string) []string { result := []string{} for _, value := range arr { value = strings.ReplaceAll(value, `"`, `\"`) + value = strings.ReplaceAll(value, `'`, `\'`) result = append(result, value) } diff --git a/pkg/tsdb/cloudwatch/metric_data_query_builder_test.go b/pkg/tsdb/cloudwatch/metric_data_query_builder_test.go index 7a8f483afea..907516f0d80 100644 --- a/pkg/tsdb/cloudwatch/metric_data_query_builder_test.go +++ b/pkg/tsdb/cloudwatch/metric_data_query_builder_test.go @@ -472,7 +472,7 @@ func TestMetricDataQueryBuilder(t *testing.T) { Namespace: "AWS/EC2", MetricName: "CPUUtilization", Dimensions: map[string][]string{ - "lb4": {`lb4""`}, + "lb4": {`lb4's""'`}, }, Period: 300, Expression: "", @@ -480,7 +480,7 @@ func TestMetricDataQueryBuilder(t *testing.T) { } res := buildSearchExpression(query, "Average") - assert.Contains(t, res, `lb4\"\"`, "Expected escape double quotes") + assert.Contains(t, res, `lb4\'s\"\"\'`, "Expected escaped quotes") }) }