influxdata / influxdata/influxdb
InfluxDB 2.0: /query API should accept Query Parameters
- Dominant language
- Rust
- Stars
- 31.7k
- Forks
- 3.7k
- Avg merge
- 13h 37m
- Merged PRs (30d)
- 8
Description
__Proposal:__
When calling: /api/v2/query in addition to the query, I would like to be able to supply a list of variable values in the post body
__Current behavior:__
You can call this by supplying a query string, where the query is a Flux query. However, to set variable, you have to replace strings in your code. For example:
```flux
|> range(start: -{$userInput}
|> filter(fn: (r) => r._measurement == "light")
|> filter(fn: (r) => r._field == "light")
```
This code takes user input, replaces "{{time}}," then stuffs it into the query payload:
```javascript
{
"query":"my replaced string",
"type":"flux"
}
```
This has many problems:
1. It is hard to write clean code in this manner. This is similar to the bad old days of dynamically creating SQL strings.
2. This makes my application vulnerable to an injection attack, so I have to take extra care.
__Desired behavior:__
Allow me to define a set of variables and pass those in separately:
```javascript
query = " |> range(start: v.timeRangeStart)
|> filter(fn: (r) => r._measurement == "light")
|> filter(fn: (r) => r._field == "light")
"
```
Then I define my payload in the following manner:
```javascript
{
"query":"$query",
"type":"flux",
"variables":{"timeRangeStart":"$userInput"}
}
```
In this code:
1. I can copy cope directly from the query designer and it works.
2. My code is much cleaner
3. Critically, I can rely on the flux engine to do type checking on the userInput, and, in this way, easily thwart injection attacks.
__Alternatives considered:__
Alternatives include sanitizing user input.
__Use case:__
This makes it much easier to use InfluxDB 2.0 as a backend in almost any language.
Contributor guide
Assessment
This issue has not been assessed yet.