#576 Escape single quotes in query interpolation

lib/fbe/regularly.rb

@@ -35,11 +35,11 @@ def Fbe.regularly(area, p_every_days, p_since_days = nil, fb: Fbe.fb, judge: $ju
   raise(Fbe::Error, 'The fb is nil') if fb.nil?
   raise(Fbe::Error, 'The $judge is not set') if judge.nil?
   raise(Fbe::Error, 'The $loog is not set') if loog.nil?
-  pmp = fb.query("(and (eq what 'pmp') (eq area '#{area}') (exists #{p_every_days}))").each.first
+  pmp = fb.query("(and (eq what 'pmp') (eq area '#{area.gsub("'", "\\\\'")}') (exists #{p_every_days}))").each.first
   interval = pmp.nil? ? 7 : pmp[p_every_days].first
   recent = fb.query(
     "(and
-      (eq what '#{judge}')
+      (eq what '#{judge.gsub("'", "\\\\'")}')
       (gt when (minus (to_time (env 'TODAY' '#{Time.now.utc.iso8601}')) '#{interval} days')))"
   ).each.first
   if recent

lib/fbe/repeatedly.rb

@@ -37,23 +37,23 @@ def Fbe.repeatedly(area, p_every_hours, fb: Fbe.fb, judge: $judge, loog: $loog,
   raise(Fbe::Error, 'The fb is nil') if fb.nil?
   raise(Fbe::Error, 'The $judge is not set') if judge.nil?
   raise(Fbe::Error, 'The $loog is not set') if loog.nil?
-  pmp = fb.query("(and (eq what 'pmp') (eq area '#{area}') (exists #{p_every_hours}))").each.first
+  pmp = fb.query("(and (eq what 'pmp') (eq area '#{area.gsub("'", "\\\\'")}') (exists #{p_every_hours}))").each.first
   hours = pmp.nil? ? 24 : pmp[p_every_hours].first
   recent = fb.query(
     "(and
-      (eq what '#{judge}')
+      (eq what '#{judge.gsub("'", "\\\\'")}')
       (gt when (minus (to_time (env 'TODAY' '#{Time.now.utc.iso8601}')) '#{hours} hours')))"
   ).each.first
   if recent
     loog.info("#{judge} was executed #{recent.when.ago} ago, skipping now (we run it every #{hours} hours)")
     return
   end
-  f = fb.query("(and (eq what '#{judge}'))").each.first
+  f = fb.query("(and (eq what '#{judge.gsub("'", "\\\\'")}'))").each.first
   if f.nil?
     f = fb.insert
     f.what = judge
   end
-  yield(fb.query("(and (eq what '#{judge}'))").each.first)
+  yield(fb.query("(and (eq what '#{judge.gsub("'", "\\\\'")}'))").each.first)
   Fbe.overwrite(f, 'when', Time.now)
   nil
 end

test/fbe/test_regularly.rb

@@ -69,4 +69,34 @@ def test_uses_default_since_days_when_pmp_lacks_property
     refute_nil(fact)
     refute_nil(fact.since)
   end
+
+  def test_area_with_single_quote
+    fb = Factbase.new
+    fb.txn do |fbt|
+      f = fbt.insert
+      f.what = 'pmp'
+      f.area = "te'st"
+      f.interval = 3
+    end
+    loog = Loog::NULL
+    Fbe.regularly("te'st", 'interval', 'days', fb:, loog:, judge: 'test') do |f|
+      f.foo = 42
+    end
+    assert_equal(2, fb.size)
+  end
+
+  def test_judge_with_single_quote
+    fb = Factbase.new
+    fb.txn do |fbt|
+      f = fbt.insert
+      f.what = 'pmp'
+      f.area = 'quality'
+      f.interval = 3
+    end
+    loog = Loog::NULL
+    Fbe.regularly('quality', 'interval', 'days', fb:, loog:, judge: "te'st") do |f|
+      f.foo = 42
+    end
+    assert_equal(2, fb.size)
+  end
 end

test/fbe/test_repeatedly.rb

@@ -66,4 +66,22 @@ def test_failed_block_does_not_lock_out_next_run
     end
     assert(ran)
   end
+
+  def test_area_with_single_quote
+    fb = Factbase.new
+    $fb = fb
+    $loog = Loog::NULL
+    $options = Judges::Options.new
+    fb.txn do |fbt|
+      f = fbt.insert
+      f.what = 'pmp'
+      f.area = "te'st"
+      f.every_x_hours = 24
+    end
+    $global = {}
+    Fbe.repeatedly("te'st", 'every_x_hours', fb:, judge: 'test') do |f|
+      f.foo = 42
+    end
+    assert_equal(2, fb.size)
+  end
 end