blazer 2.5.0 → 2.6.0

data/app/views/blazer/dashboards/show.html.erb

@@ -10,7 +10,7 @@
         </h3>
       </div>
       <div class="col-sm-3 text-right">
-        <%= link_to "Edit", edit_dashboard_path(@dashboard, variable_params(@dashboard)), class: "btn btn-info" %>
+        <%= link_to "Edit", edit_dashboard_path(@dashboard, params: variable_params(@dashboard)), class: "btn btn-info" %>
       </div>
     </div>
   </div>
@@ -21,7 +21,7 @@
 <% if @data_sources.any? { |ds| ds.cache_mode != "off" } %>
   <p class="text-muted" style="float: right;">
     Some queries may be cached
-    <%= link_to "Refresh", refresh_dashboard_path(@dashboard, variable_params(@dashboard)), method: :post %>
+    <%= link_to "Refresh", refresh_dashboard_path(@dashboard, params: variable_params(@dashboard)), method: :post %>
   </p>
 <% end %>
 
@@ -33,13 +33,13 @@
 
 <% @queries.each_with_index do |query, i| %>
   <div class="chart-container">
-    <h4><%= link_to query.friendly_name, query_path(query, variable_params(query)), target: "_blank" %></h4>
+    <h4><%= link_to query.friendly_name, query_path(query, params: variable_params(query)), target: "_blank" %></h4>
     <div id="chart-<%= i %>" class="chart">
       <p class="text-muted">Loading...</p>
     </div>
   </div>
   <script>
-    <%= blazer_js_var "data", {statement: @statements[i], query_id: query.id, data_source: query.data_source, only_chart: true, cohort_period: params[:cohort_period]} %>
+    <%= blazer_js_var "data", {statement: query.statement, query_id: query.id, variables: variable_params(query), only_chart: true, cohort_period: params[:cohort_period]} %>
 
     runQuery(data, function (data) {
       $("#chart-<%= i %>").html(data)

data/app/views/blazer/queries/_caching.html.erb

@@ -10,7 +10,7 @@
     <% end %>
 
     <% if @query && params[:query_id] %>
-      <%= link_to "Refresh", refresh_query_path(@query, variable_params(@query)), method: :post %>
+      <%= link_to "Refresh", refresh_query_path(@query, params: variable_params(@query, @var_params)), method: :post %>
     <% end %>
   </p>
 <% end %>

data/app/views/blazer/queries/_form.html.erb

@@ -3,7 +3,7 @@
 <% end %>
 
 <div id="app" v-cloak>
-  <%= form_for @query, url: (@query.persisted? ? query_path(@query, variable_params(@query)) : queries_path(variable_params(@query))), html: {autocomplete: "off"} do |f| %>
+  <%= form_for @query, url: (@query.persisted? ? query_path(@query, params: variable_params(@query)) : queries_path(params: variable_params(@query))), html: {autocomplete: "off"} do |f| %>
     <div class="row">
       <div id="statement-box" class="col-xs-8">
         <div class= "form-group">
@@ -67,7 +67,7 @@
 </div>
 
 <script>
-  <%= blazer_js_var "params", variable_params(@query) %>
+  <%= blazer_js_var "variableParams", variable_params(@query) %>
   <%= blazer_js_var "previewStatement", Hash[Blazer.data_sources.map { |k, v| [k, (v.preview_statement rescue "")] }] %>
 
   var app = new Vue({
@@ -95,7 +95,7 @@
         this.error = false
         cancelAllQueries()
 
-        var data = $.extend({}, params, {statement: this.getSQL(), data_source: $("#query_data_source").val()})
+        var data = {statement: this.getSQL(), data_source: $("#query_data_source").val(), variables: variableParams}
 
         var _this = this
 

data/app/views/blazer/queries/run.html.erb

@@ -31,7 +31,7 @@
 
       <% if @query && @result.forecastable? && !params[:forecast] %>
         &middot;
-        <%= link_to "Forecast", query_path(@query, {forecast: "t"}.merge(variable_params(@query))) %>
+        <%= link_to "Forecast", query_path(@query, params: {forecast: "t"}.merge(variable_params(@query))) %>
       <% end %>
     </p>
   <% end %>

data/app/views/blazer/queries/show.html.erb

@@ -1,5 +1,12 @@
 <% blazer_title @query.name %>
 
+<% if @success %>
+  <% run_data = {statement: @query.statement, query_id: @query.id, variables: variable_params(@query)} %>
+  <% run_data.merge!(forecast: "t") if params[:forecast] %>
+  <% run_data.merge!(cohort_period: params[:cohort_period]) if params[:cohort_period] %>
+  <% run_data.transform_keys!(&:to_s) if Rails::VERSION::STRING.to_f == 5.0 %>
+<% end %>
+
 <div class="topbar">
   <div class="container">
     <div class="row" style="padding-top: 13px;">
@@ -10,11 +17,11 @@
         </h3>
       </div>
       <div class="col-sm-3 text-right">
-        <%= link_to "Edit", edit_query_path(@query, variable_params(@query)), class: "btn btn-default", disabled: !@query.editable?(blazer_user) %>
-        <%= link_to "Fork", new_query_path(variable_params(@query).merge(fork_query_id: @query.id, data_source: @query.data_source, name: @query.name)), class: "btn btn-info" %>
+        <%= link_to "Edit", edit_query_path(@query, params: variable_params(@query)), class: "btn btn-default", disabled: !@query.editable?(blazer_user) %>
+        <%= link_to "Fork", new_query_path(params: variable_params(@query).merge(fork_query_id: @query.id, data_source: @query.data_source, name: @query.name)), class: "btn btn-info" %>
 
         <% if !@error && @success %>
-          <%= button_to "Download", run_queries_path(query_id: @query.id, format: "csv", forecast: params[:forecast], cohort_period: params[:cohort_period]), params: {statement: @statement}, class: "btn btn-primary" %>
+          <%= button_to "Download", run_queries_path(format: "csv"), params: run_data, class: "btn btn-primary" %>
         <% end %>
       </div>
     </div>
@@ -39,7 +46,7 @@
 
 <%= render partial: "blazer/variables", locals: {action: query_path(@query)} %>
 
-<pre id="code"><code><%= @statement %></code></pre>
+<pre id="code"><code><%= @statement.display_statement %></code></pre>
 
 <% if @success %>
   <div id="results">
@@ -56,9 +63,7 @@
       $("#results").addClass("query-error").html(message)
     }
 
-    <% data = variable_params(@query).merge(statement: @statement, query_id: @query.id, data_source: @query.data_source) %>
-    <% data.merge!(forecast: "t") if params[:forecast] %>
-    <%= blazer_js_var "data", data %>
+    <%= blazer_js_var "data", run_data %>
 
     runQuery(data, showRun, showError)
   </script>

data/app/views/layouts/blazer/application.html.erb

@@ -5,8 +5,13 @@
 
     <meta charset="utf-8" />
     <%= favicon_link_tag "blazer/favicon.png" %>
-    <%= stylesheet_link_tag "blazer/application" %>
-    <%= javascript_include_tag "blazer/application" %>
+    <% if defined?(Propshaft::Railtie) %>
+      <%= stylesheet_link_tag "blazer/bootstrap-propshaft", "blazer/bootstrap", "blazer/selectize", "blazer/github", "blazer/daterangepicker", "blazer/application" %>
+      <%= javascript_include_tag "blazer/jquery", "blazer/jquery-ujs", "blazer/stupidtable", "blazer/stupidtable-custom-settings", "blazer/jquery.stickytableheaders", "blazer/selectize", "blazer/highlight.min", "blazer/moment", "blazer/moment-timezone-with-data", "blazer/daterangepicker", "blazer/Chart.js", "blazer/chartkick", "blazer/ace/ace", "blazer/ace/ext-language_tools", "blazer/ace/theme-twilight", "blazer/ace/mode-sql", "blazer/ace/snippets/text", "blazer/ace/snippets/sql", "blazer/Sortable", "blazer/bootstrap", "blazer/vue", "blazer/routes", "blazer/queries", "blazer/fuzzysearch", "blazer/application" %>
+    <% else %>
+      <%= stylesheet_link_tag "blazer/application" %>
+      <%= javascript_include_tag "blazer/application" %>
+    <% end %>
     <script>
       <%= blazer_js_var "rootPath", root_path %>
     </script>

data/lib/blazer/adapters/athena_adapter.rb

@@ -1,31 +1,50 @@
 module Blazer
   module Adapters
     class AthenaAdapter < BaseAdapter
-      def run_statement(statement, comment)
+      def run_statement(statement, comment, bind_params = [])
         require "digest/md5"
 
         columns = []
         rows = []
         error = nil
 
-        query_options = {
-          query_string: statement,
-          # use token so we fetch cached results after query is run
-          client_request_token: Digest::MD5.hexdigest([statement, data_source.id, settings["workgroup"]].compact.join("/")),
-          query_execution_context: {
-            database: database,
+        begin
+          # use empty? since any? doesn't work for [nil]
+          if !bind_params.empty?
+            request_token = Digest::MD5.hexdigest([statement, bind_params.to_json, data_source.id, settings["workgroup"]].compact.join("/"))
+            statement_name = "blazer_#{request_token}"
+            begin
+              client.create_prepared_statement({
+                statement_name: statement_name,
+                work_group: settings["workgroup"],
+                query_statement: statement
+              })
+            rescue Aws::Athena::Errors::InvalidRequestException => e
+              raise e unless e.message.include?("already exists in WorkGroup")
+            end
+            using_statement = bind_params.map { |v| data_source.quote(v) }.join(", ")
+            statement = "EXECUTE #{statement_name} USING #{using_statement}"
+          else
+            request_token = Digest::MD5.hexdigest([statement, data_source.id, settings["workgroup"]].compact.join("/"))
+          end
+
+          query_options = {
+            query_string: statement,
+            # use token so we fetch cached results after query is run
+            client_request_token: request_token,
+            query_execution_context: {
+              database: database,
+            }
           }
-        }
 
-        if settings["output_location"]
-          query_options[:result_configuration] = {output_location: settings["output_location"]}
-        end
+          if settings["output_location"]
+            query_options[:result_configuration] = {output_location: settings["output_location"]}
+          end
 
-        if settings["workgroup"]
-          query_options[:work_group] = settings["workgroup"]
-        end
+          if settings["workgroup"]
+            query_options[:work_group] = settings["workgroup"]
+          end
 
-        begin
           resp = client.start_query_execution(**query_options)
           query_execution_id = resp.query_execution_id
 
@@ -111,12 +130,29 @@ module Blazer
         "SELECT * FROM {table} LIMIT 10"
       end
 
+      # https://docs.aws.amazon.com/athena/latest/ug/select.html#select-escaping
+      def quoting
+        :single_quote_escape
+      end
+
+      # https://docs.aws.amazon.com/athena/latest/ug/querying-with-prepared-statements.html
+      def parameter_binding
+        engine_version > 1 ? :positional : nil
+      end
+
       private
 
       def database
         @database ||= settings["database"] || "default"
       end
 
+      # note: this setting is experimental
+      # it does *not* need to be set to use engine version 2
+      # prepared statements must be manually deleted if enabled
+      def engine_version
+        @engine_version ||= (settings["engine_version"] || 1).to_i
+      end
+
       def fetch_error(query_execution_id)
         client.get_query_execution(
           query_execution_id: query_execution_id

data/lib/blazer/adapters/base_adapter.rb

@@ -8,7 +8,22 @@ module Blazer
       end
 
       def run_statement(statement, comment)
-        # the one required method
+        # required
+      end
+
+      def quoting
+        # required, how to quote variables
+        # :backslash_escape - single quote strings and convert ' to \' and \ to \\
+        # :single_quote_escape - single quote strings and convert ' to ''
+        # ->(value) { ... } - custom method
+      end
+
+      def parameter_binding
+        # optional, but recommended when possible for security
+        # if specified, quoting is only used for display
+        # :positional - ?
+        # :numeric - $1
+        # ->(statement, values) { ... } - custom method
       end
 
       def tables

data/lib/blazer/adapters/bigquery_adapter.rb

@@ -1,13 +1,13 @@
 module Blazer
   module Adapters
     class BigQueryAdapter < BaseAdapter
-      def run_statement(statement, comment)
+      def run_statement(statement, comment, bind_params)
         columns = []
         rows = []
         error = nil
 
         begin
-          results = bigquery.query(statement)
+          results = bigquery.query(statement, params: bind_params)
 
           # complete? was removed in google-cloud-bigquery 0.29.0
           # code is for backward compatibility
@@ -19,6 +19,7 @@ module Blazer
           end
         rescue => e
           error = e.message
+          error = Blazer::VARIABLE_MESSAGE if error.include?("Syntax error: Unexpected \"?\"")
         end
 
         [columns, rows, error]
@@ -42,6 +43,16 @@ module Blazer
         "SELECT * FROM `{table}` LIMIT 10"
       end
 
+      # https://cloud.google.com/bigquery/docs/reference/standard-sql/lexical#string_and_bytes_literals
+      def quoting
+        :backslash_escape
+      end
+
+      # https://cloud.google.com/bigquery/docs/parameterized-queries
+      def parameter_binding
+        :positional
+      end
+
       private
 
       def bigquery

data/lib/blazer/adapters/cassandra_adapter.rb

@@ -1,28 +1,29 @@
 module Blazer
   module Adapters
     class CassandraAdapter < BaseAdapter
-      def run_statement(statement, comment)
+      def run_statement(statement, comment, bind_params)
         columns = []
         rows = []
         error = nil
 
         begin
-          response = session.execute("#{statement} /*#{comment}*/")
+          response = session.execute("#{statement} /*#{comment}*/", arguments: bind_params)
           rows = response.map { |r| r.values }
           columns = rows.any? ? response.first.keys : []
         rescue => e
           error = e.message
+          error = Blazer::VARIABLE_MESSAGE if error.include?("no viable alternative at input '?'")
         end
 
         [columns, rows, error]
       end
 
       def tables
-        session.execute("SELECT table_name FROM system_schema.tables WHERE keyspace_name = '#{keyspace}'").map { |r| r["table_name"] }
+        session.execute("SELECT table_name FROM system_schema.tables WHERE keyspace_name = #{data_source.quote(keyspace)}").map { |r| r["table_name"] }
       end
 
       def schema
-        result = session.execute("SELECT keyspace_name, table_name, column_name, type, position FROM system_schema.columns WHERE keyspace_name = '#{keyspace}'")
+        result = session.execute("SELECT keyspace_name, table_name, column_name, type, position FROM system_schema.columns WHERE keyspace_name = #{data_source.quote(keyspace)}")
         result.map(&:values).group_by { |r| [r[0], r[1]] }.map { |k, vs| {schema: k[0], table: k[1], columns: vs.sort_by { |v| v[2] }.map { |v| {name: v[2], data_type: v[3]} }} }
       end
 
@@ -30,6 +31,16 @@ module Blazer
         "SELECT * FROM {table} LIMIT 10"
       end
 
+      # https://docs.datastax.com/en/cql-oss/3.3/cql/cql_reference/escape_char_r.html
+      def quoting
+        :single_quote_escape
+      end
+
+      # https://docs.datastax.com/en/developer/nodejs-driver/3.0/features/parameterized-queries/
+      def parameter_binding
+        :positional
+      end
+
       private
 
       def cluster

data/lib/blazer/adapters/drill_adapter.rb

@@ -18,6 +18,16 @@ module Blazer
         [columns, rows, error]
       end
 
+      # https://drill.apache.org/docs/lexical-structure/#string
+      def quoting
+        :single_quote_escape
+      end
+
+      # https://issues.apache.org/jira/browse/DRILL-5079
+      def parameter_binding
+        # not supported
+      end
+
       private
 
       def drill

data/lib/blazer/adapters/druid_adapter.rb

@@ -3,15 +3,37 @@ module Blazer
     class DruidAdapter < BaseAdapter
       TIMESTAMP_REGEX = /\A\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z\z/
 
-      def run_statement(statement, comment)
+      def run_statement(statement, comment, bind_params)
+        require "json"
+        require "net/http"
+        require "uri"
+
         columns = []
         rows = []
         error = nil
 
+        params =
+          bind_params.map do |v|
+            type =
+              case v
+              when Integer
+                "BIGINT"
+              when Float
+                "DOUBLE"
+              when ActiveSupport::TimeWithZone
+                v = (v.to_f * 1000).round
+                "TIMESTAMP"
+              else
+                "VARCHAR"
+              end
+            {type: type, value: v}
+          end
+
         header = {"Content-Type" => "application/json", "Accept" => "application/json"}
         timeout = data_source.timeout ? data_source.timeout.to_i : 300
         data = {
           query: statement,
+          parameters: params,
           context: {
             timeout: timeout * 1000
           }
@@ -27,6 +49,8 @@ module Blazer
             error = response["errorMessage"] || "Unknown error: #{response.inspect}"
             if error.include?("timed out")
               error = Blazer::TIMEOUT_MESSAGE
+            elsif error.include?("Encountered \"?\" at")
+              error = Blazer::VARIABLE_MESSAGE
             end
           else
             columns = (response.first || {}).keys
@@ -62,6 +86,17 @@ module Blazer
       def preview_statement
         "SELECT * FROM {table} LIMIT 10"
       end
+
+      # https://druid.apache.org/docs/latest/querying/sql.html#identifiers-and-literals
+      # docs only mention double quotes
+      def quoting
+        :single_quote_escape
+      end
+
+      # https://druid.apache.org/docs/latest/querying/sql.html#dynamic-parameters
+      def parameter_binding
+        :positional
+      end
     end
   end
 end

data/lib/blazer/adapters/elasticsearch_adapter.rb

@@ -1,13 +1,13 @@
 module Blazer
   module Adapters
     class ElasticsearchAdapter < BaseAdapter
-      def run_statement(statement, comment)
+      def run_statement(statement, comment, bind_params)
         columns = []
         rows = []
         error = nil
 
         begin
-          response = client.transport.perform_request("POST", endpoint, {}, {query: "#{statement} /*#{comment}*/"}).body
+          response = client.transport.perform_request("POST", endpoint, {}, {query: "#{statement} /*#{comment}*/", params: bind_params}).body
           columns = response["columns"].map { |v| v["name"] }
           # Elasticsearch does not differentiate between dates and times
           date_indexes = response["columns"].each_index.select { |i| ["date", "datetime"].include?(response["columns"][i]["type"]) }
@@ -21,6 +21,7 @@ module Blazer
           end
         rescue => e
           error = e.message
+          error = Blazer::VARIABLE_MESSAGE if error.include?("mismatched input '?'")
         end
 
         [columns, rows, error]
@@ -36,6 +37,16 @@ module Blazer
         "SELECT * FROM \"{table}\" LIMIT 10"
       end
 
+      # https://www.elastic.co/guide/en/elasticsearch/reference/current/sql-lexical-structure.html#sql-syntax-string-literals
+      def quoting
+        :single_quote_escape
+      end
+
+      # https://www.elastic.co/guide/en/elasticsearch/reference/current/sql-rest-params.html
+      def parameter_binding
+        :positional
+      end
+
       protected
 
       def endpoint

data/lib/blazer/adapters/hive_adapter.rb

@@ -25,6 +25,16 @@ module Blazer
         "SELECT * FROM {table} LIMIT 10"
       end
 
+      # https://cwiki.apache.org/confluence/display/Hive/LanguageManual+Types#LanguageManualTypes-StringsstringStrings
+      def quoting
+        :backslash_escape
+      end
+
+      # has variable substitution, but sets for session
+      # https://cwiki.apache.org/confluence/display/Hive/LanguageManual+VariableSubstitution
+      def parameter_binding
+      end
+
       protected
 
       def client

data/lib/blazer/adapters/ignite_adapter.rb

@@ -1,13 +1,13 @@
 module Blazer
   module Adapters
     class IgniteAdapter < BaseAdapter
-      def run_statement(statement, comment)
+      def run_statement(statement, comment, bind_params)
         columns = []
         rows = []
         error = nil
 
         begin
-          result = client.query("#{statement} /*#{comment}*/", schema: default_schema, statement_type: :select, timeout: data_source.timeout)
+          result = client.query("#{statement} /*#{comment}*/", bind_params, schema: default_schema, statement_type: :select, timeout: data_source.timeout)
           columns = result.any? ? result.first.keys : []
           rows = result.map(&:values)
         rescue => e
@@ -37,6 +37,16 @@ module Blazer
       #   result.rows.group_by { |r| [r[0], r[1]] }.map { |k, vs| {schema: k[0], table: k[1], columns: vs.sort_by { |v| v[2] }.map { |v| {name: v[2], data_type: v[3]} }} }.sort_by { |t| [t[:schema] == default_schema ? "" : t[:schema], t[:table]] }
       # end
 
+      def quoting
+        :single_quote_escape
+      end
+
+      # query arguments
+      # https://ignite.apache.org/docs/latest/binary-client-protocol/sql-and-scan-queries#op_query_sql
+      def parameter_binding
+        :positional
+      end
+
       private
 
       def default_schema

data/lib/blazer/adapters/influxdb_adapter.rb

@@ -8,16 +8,19 @@ module Blazer
 
         begin
           result = client.query(statement, denormalize: false).first
-          columns = result["columns"]
-          rows = result["values"]
-
-          # parse time columns
-          # current approach isn't ideal, but result doesn't include types
-          # another approach would be to check the format
-          time_index = columns.index("time")
-          if time_index
-            rows.each do |row|
-              row[time_index] = Time.parse(row[time_index]) if row[time_index]
+
+          if result
+            columns = result["columns"]
+            rows = result["values"]
+
+            # parse time columns
+            # current approach isn't ideal, but result doesn't include types
+            # another approach would be to check the format
+            time_index = columns.index("time")
+            if time_index
+              rows.each do |row|
+                row[time_index] = Time.parse(row[time_index]) if row[time_index]
+              end
             end
           end
         rescue => e
@@ -35,6 +38,15 @@ module Blazer
         "SELECT * FROM {table} LIMIT 10"
       end
 
+      # https://docs.influxdata.com/influxdb/v1.8/query_language/spec/#strings
+      def quoting
+        :backslash_escape
+      end
+
+      def parameter_binding
+        # not supported
+      end
+
       protected
 
       def client

data/lib/blazer/adapters/mongodb_adapter.rb

@@ -25,6 +25,10 @@ module Blazer
         "db.{table}.find().limit(10)"
       end
 
+      def quoting
+        :backslash_escape
+      end
+
       protected
 
       def client

data/lib/blazer/adapters/neo4j_adapter.rb

@@ -1,13 +1,13 @@
 module Blazer
   module Adapters
     class Neo4jAdapter < BaseAdapter
-      def run_statement(statement, comment)
+      def run_statement(statement, comment, bind_params)
         columns = []
         rows = []
         error = nil
 
         begin
-          result = session.query("#{statement} /*#{comment}*/")
+          result = session.query("#{statement} /*#{comment}*/", bind_params)
           columns = result.columns.map(&:to_s)
           rows = []
           result.each do |row|
@@ -19,6 +19,7 @@ module Blazer
           end
         rescue => e
           error = e.message
+          error = Blazer::VARIABLE_MESSAGE if error.include?("Invalid input '$'")
         end
 
         [columns, rows, error]
@@ -33,6 +34,20 @@ module Blazer
         "MATCH (n:{table}) RETURN n LIMIT 10"
       end
 
+      # https://neo4j.com/docs/cypher-manual/current/syntax/expressions/#cypher-expressions-string-literals
+      def quoting
+        :backslash_escape
+      end
+
+      def parameter_binding
+        proc do |statement, variables|
+          variables.each_key do |k|
+            statement = statement.gsub("{#{k}}") { "$#{k} " }
+          end
+          [statement, variables]
+        end
+      end
+
       protected
 
       def session

data/lib/blazer/adapters/opensearch_adapter.rb

@@ -38,6 +38,10 @@ module Blazer
         "SELECT * FROM `{table}` LIMIT 10"
       end
 
+      def quoting
+        # unknown
+      end
+
       protected
 
       def client

data/lib/blazer/adapters/presto_adapter.rb

@@ -25,6 +25,15 @@ module Blazer
         "SELECT * FROM {table} LIMIT 10"
       end
 
+      def quoting
+        :single_quote_escape
+      end
+
+      # TODO support prepared statements - https://prestodb.io/docs/current/sql/prepare.html
+      # feature request for variables - https://github.com/prestodb/presto/issues/5918
+      def parameter_binding
+      end
+
       protected
 
       def client