mirror of
https://github.com/chatwoot/chatwoot.git
synced 2026-06-13 21:01:16 +08:00
67112647e8
Creating a Linear issue from Chatwoot fails with a GraphQL parse error
when the title, description, or search term contains double quotes. For
example, a description like `the sender is "Bot"` produces this broken
query:
```graphql
issueCreate(input: { description: "the sender is "Bot"" })
```
Linear's API rejects this with `Syntax Error: Expected ":", found
String`. This affects issue creation, issue linking, and issue search —
any flow where user-provided text is interpolated into a GraphQL query.
The `graphql_value` helper was only escaping newlines (`\n`) but not
quotes, backslashes, or other characters that are meaningful inside a
GraphQL string literal. On top of that, `issue_link` and `search_issue`
bypassed `graphql_value` entirely, using raw string interpolation
instead.
The fix replaces the manual `gsub` escaping with Ruby's `to_json`, which
produces a properly escaped, double-quoted string that handles all
special characters. This is a minimal, well-understood substitution —
`to_json` on a Ruby string returns a valid JSON string literal, which is
also a valid GraphQL string literal since GraphQL uses the same escaping
rules. The `issue_link` mutation and `search_issue` query are updated to
route their parameters through `graphql_value` instead of raw
interpolation.
The `team_entities_query` and `linked_issues` methods in `queries.rb`
also use raw interpolation, but their inputs are system-generated IDs
and URLs rather than user-provided text, so they're left as-is to keep
this change focused.
|
||
|---|---|---|
| .. | ||
| action_view/template/handlers | ||
| assets | ||
| captain | ||
| custom_exceptions | ||
| events | ||
| filters | ||
| integrations | ||
| linear | ||
| llm | ||
| redis | ||
| seeders | ||
| tasks | ||
| test_data | ||
| webhooks | ||
| base_markdown_renderer.rb | ||
| chatwoot_app.rb | ||
| chatwoot_captcha.rb | ||
| chatwoot_exception_tracker.rb | ||
| chatwoot_hub.rb | ||
| chatwoot_markdown_renderer.rb | ||
| config_loader.rb | ||
| current.rb | ||
| custom_markdown_renderer.rb | ||
| dyte.rb | ||
| exception_list.rb | ||
| global_config_service.rb | ||
| global_config.rb | ||
| limits.rb | ||
| linear.rb | ||
| llm_constants.rb | ||
| microsoft_graph_auth.rb | ||
| online_status_tracker.rb | ||
| opentelemetry_config.rb | ||
| regex_helper.rb | ||
| test_data.rb | ||
| url_helper.rb | ||
| vapid_service.rb | ||