influxdata / influxdata/influxdb

InfluxDB 2.0: /query API should accept Query Parameters

Open
#16,109 16 comments 1 reaction 1 assignee Claimed by @dgnorton View on GitHub
area/2.x area/api area/queries
Dominant language
Rust
Stars
31.7k
Forks
3.7k
Avg merge
13h 37m
Merged PRs (30d)
8

Description

__Proposal:__
When calling: /api/v2/query in addition to the query, I would like to be able to supply a list of variable values in the post body

__Current behavior:__
You can call this by supplying a query string, where the query is a Flux query. However, to set variable, you have to replace strings in your code. For example:

```flux
|> range(start: -{$userInput}
|> filter(fn: (r) => r._measurement == "light")
|> filter(fn: (r) => r._field == "light")
```
This code takes user input, replaces "{{time}}," then stuffs it into the query payload:

```javascript
{
"query":"my replaced string",
"type":"flux"
}
```

This has many problems:

1. It is hard to write clean code in this manner. This is similar to the bad old days of dynamically creating SQL strings.
2. This makes my application vulnerable to an injection attack, so I have to take extra care.

__Desired behavior:__
Allow me to define a set of variables and pass those in separately:

```javascript
query = " |> range(start: v.timeRangeStart)
|> filter(fn: (r) => r._measurement == "light")
|> filter(fn: (r) => r._field == "light")
"
```
Then I define my payload in the following manner:

```javascript
{
"query":"$query",
"type":"flux",
"variables":{"timeRangeStart":"$userInput"}
}
```

In this code:
1. I can copy cope directly from the query designer and it works.
2. My code is much cleaner
3. Critically, I can rely on the flux engine to do type checking on the userInput, and, in this way, easily thwart injection attacks.

__Alternatives considered:__
Alternatives include sanitizing user input.

__Use case:__
This makes it much easier to use InfluxDB 2.0 as a backend in almost any language.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.